Issue No. 5 · Week of September 21–28, 2026

Nobody Checked Until Somebody Did

By Rowa Taha

This week's stories share a mechanism more than a topic: a public commitment, a safety pledge, an age-check feature, an advance warning, that held up fine until an outside party actually tested it.

AI Governance — Global

OpenAI and Anthropic Ask the UN for Rules. Washington Says No.

At a Sept. 23 UN Security Council session, OpenAI CEO Sam Altman asked the 15-member body to help standardize how countries measure AI capabilities and report system failures. Anthropic CEO Dario Amodei proposed something narrower: binding international agreements specifically on preventing bio-weapons misuse and requiring "loss-of-control" testing, meaning tests to confirm an AI system can still be shut down or contained if it starts behaving in ways its developers didn't intend. Amodei told the council that "AI could be a risk to humanity as a whole."[1][2]

The US delegation rejected the idea of "global governance" of AI outright in its response, without engaging with either proposal specifically. The session closed with no joint statement and no working group formed.[1][3]

Any resolution out of the Security Council requires US support, since the US holds a permanent veto, so nothing here changes the regulatory landscape today. What it does establish is a public record: two of the industry's most prominent labs are now on record asking for international oversight measures their own government has explicitly refused to consider. I think that gap, not the meeting itself, is the actual story. It puts pressure on both companies to explain, the next time capability standards or bio-risk testing comes up domestically, why they'll accept from Washington what they just asked the UN to impose.[2][3]

CNN Business → Al Jazeera → Rappler →

International Treaty — India

India Signs the World's First Global Cybercrime Treaty

External Affairs Minister S. Jaishankar signed the UN Convention against Cybercrime on Sept. 25 at UN Headquarters, making India the latest of 91 countries to put their name on the first binding global framework for cross-border cybercrime cooperation. The treaty sets shared standards for evidence-sharing between countries, extradition, and joint investigations into ransomware and online fraud networks that cross national borders, something individual countries have struggled to coordinate on for years.[1][2]

Signing and ratifying are two different steps, and the gap between them here is wide. Only three of the 91 signatories, Qatar, Azerbaijan, and Vietnam, have actually ratified the treaty so far. It needs 40 ratifications before it takes effect for anyone at all. Ratification is a domestic legislative process separate from signing, and it can stall for years even in countries whose governments support the treaty in principle.[1]

The signature window stays open through the end of 2026, so more countries will likely add their names before the harder question, who actually ratifies, gets answered. Which early signatories move first on ratification will say more about this treaty's real chances than the signing count ever will.[2][3]

UNODC (official) → UN (official) → CyberPeace Foundation →

Big Tech / Antitrust — United States

Four AI Labs Get Sued Over Their Own Safety Pledge

On Sept. 12, Anthropic CEO Dario Amodei publicly urged the AI industry to slow model releases for safety reasons. OpenAI's Sam Altman, xAI's Elon Musk, and Google DeepMind's Demis Hassabis each responded in public agreement that same day, an unusual moment of alignment between four labs that otherwise compete on almost everything. A week later, on Sept. 19, a class action filed in the Northern District of California turned that agreement into a legal claim: that the labs' coordinated statement was an illegal pact to substitute collective restraint for individual competition.[1][2]

The legal theory reframes what looked, on its face, like responsible self-governance. The complaint argues that paying subscribers who expected competitive pressure to keep driving rapid product improvement instead got four labs agreeing, in public and on the same day, to slow down together. That coordination, the suit claims, shortchanged subscribers rather than protecting anyone.[1][3]

Whether this survives a motion to dismiss is genuinely open. A public statement of shared values isn't automatically proof of an antitrust conspiracy, and the labs will likely argue the timing reflected a shared response to the same external safety research, not coordination among themselves. Still, the case sets a precedent worth tracking: a public commitment to "doing this responsibly" is now something that can be tested in discovery, not just repeated in press coverage.[2][3]

CNN Business → Euronews → PBS NewsHour →

Big Tech / Regulation — European Union

Brussels Wants to Call AWS and Azure "Gatekeepers." The Companies Get Until Fall to Argue Back.

The European Commission reached a preliminary position on June 25, 2026 that Amazon's AWS and Microsoft's Azure, the two largest cloud providers operating in the EU, should be designated as Digital Markets Act "gatekeepers," a status so far applied mostly to consumer-facing platforms like search engines and app stores. The Commission's concern is specifically about AI: bundling proprietary AI models and tooling directly into cloud infrastructure creates lock-in, making it harder for EU businesses to switch providers once they've built their AI stack on top of a given cloud.[1][2]

Both companies are in their formal response window this September, arguing their case before Brussels makes a final call. If the designation is confirmed, they'd get six months to comply with interoperability requirements and data-access obligations meant to let customers and competitors move more freely between providers. DMA fines for non-compliance can reach 10% of a company's global annual turnover, not just its EU revenue.[1]

This would be the first time gatekeeper status has been applied to infrastructure-layer cloud computing rather than a consumer platform. That matters regardless of the outcome, since it tests whether the "gatekeeper" category can stretch to cover the layer AI products actually run on, not just the apps people click on.[2][3]

EU DMA (official) → The Register → DataCenterDynamics →

Lawsuit — Canada

A Province Is Suing OpenAI Over a Mass Shooting Its Reviewers Reportedly Saw Coming

Content note: this story involves a school shooting and suicide. British Columbia sued OpenAI and Sam Altman on Sept. 22, 2026 in US federal court over the deadliest school shooting in the province's history. The complaint alleges that OpenAI's own human content reviewers flagged a teenager's repeated references to gun violence in ChatGPT conversations in June 2025, and internally recommended notifying Canadian police, but no warning was sent. In February 2026, that same teenager killed an educational assistant and five students, all 12 and 13 years old, along with her own mother and stepbrother, before taking her own life at Tumbler Ridge Secondary School.[1][2][3]

The lawsuit's central claim isn't about what the AI said to her. It's about what OpenAI's own safety process reportedly already knew and didn't act on. If the account of a reviewer flagging the conversations and recommending a police notification holds up, this becomes a case about whether a company followed its own stated safety protocol once a real warning sign appeared in front of an actual employee, not a novel question about AI-caused harm.[1][2]

BC is seeking damages, but also a court order requiring OpenAI to change how it handles conversations flagged internally as threatening. If granted, that would be a rare instance of litigation directly dictating a specific company's internal review procedures, not just its financial liability.[3]

Al Jazeera → Canada's National Observer → CBC News →

Lawsuit — United States

Roblox and Discord Say a Sexual-Assault Survivor Law Doesn't Cover What Happened on Their Apps

Content note: this story involves child sexual exploitation litigation. On Sept. 23, 2026, Roblox and Discord asked a California federal judge to send bellwether claims in a child sexual exploitation multidistrict litigation to private arbitration. Their argument rests on a narrow reading of the Ending Forced Arbitration of Sexual Assault and Sexual Harassment Act, the 2022 federal law letting survivors bypass forced-arbitration clauses in sexual assault or harassment cases. The companies contend the law only applies when the platform itself commits the misconduct, not when a third-party user does.[1][2]

That argument has already lost once. A California state court rejected the identical position in February 2026, ruling the law's language is "expansive" enough to cover platform liability even when the direct abuse was committed by another user. Roblox and Discord are now making the same argument in federal court, on the multidistrict litigation track, where the earlier state ruling doesn't bind the outcome.[1][3]

The stakes reach well past these two companies. Arbitration clauses are standard in nearly every platform's terms of service, so a federal ruling on whether the law reaches platform-liability claims will likely set the template for every other tech company facing similar child-safety claims. A win for Roblox and Discord here hands every major platform a roadmap for routing future claims out of open court.[2][3]

MLex → Law360 → HarrisMartin →

AI Governance — Brazil

Brazil Gives ChatGPT, Claude, Gemini and Five Others 10 Days to Explain Their Deepfake Filters

Brazil's data protection authority, ANPD, opened a compliance sweep in August 2026 covering 22 platforms total, both social networks and AI tools, over safeguards against generating or editing non-consensual intimate imagery. Eight AI providers were named specifically: Google Play, Apple's App Store, Microsoft Copilot, Anthropic's Claude, DeepSeek, Google's Gemini, OpenAI's ChatGPT, Meta AI, and Perplexity, each given 10 working days to detail exactly how their filtering and detection systems work.[1][2]

Regulators asking companies to explain their systems within a set window is routine. What's notable here is the level of detail demanded. ANPD isn't asking whether these tools have policies against non-consensual intimate content, it's asking for the technical specifics of detection and filtering, a much harder question to answer with a policy document alone.[2][3]

Folding foundation-model providers into the same sweep as social platforms treats "can this app generate the harmful content" and "does this app host the harmful content" as the same regulatory question, a framing other privacy authorities haven't uniformly adopted. Whether ANPD's answers lead to actual enforcement, or just a compliance paper trail, is what determines whether this sweep amounts to anything.[1][3]

TechPolicy.Press → CNN Brasil → Olhar Digital →

Accountability — Japan

Seven Japanese Ministries Tell Google, Meta and X: Stop the Deepfake Investment Scams

Japan's Digital Agency, National Police Agency, and five other ministries jointly demanded on Aug. 7, 2026 that Google, Meta, TikTok Japan, LINE Yahoo, and X tighten advertiser verification, after a wave of deepfake ads impersonating Japanese celebrities and business figures was used to push investment fraud. Verification plans are due Oct. 16, with full compliance reports required by March 16, 2027. Separate reporting put losses from the scam wave at roughly $804 million.[1][2][3]

The detail that stands out most is timing, not money. Separate reporting found Meta had roughly six weeks' advance notice of the coming government request before it was formally issued, and critics argue the company prioritized ad revenue over tightening verification in that window. Six weeks is enough time to meaningfully slow a known ad-fraud pattern if a platform is motivated to act on it.[3]

Seven ministries coordinating on a single demand signals this crossed the threshold from consumer protection nuisance to a cross-agency financial fraud priority. Whether the October verification deadline produces real changes, or just paperwork ahead of the harder March compliance date, will show whether that pressure actually worked.[1][2]

Digital Agency of Japan (official) → MLex → Tech Times →

Legislation — Australia

Australia Passed a Law Making Big Tech Pay for News, or Deal With at Least Eight Publishers

Australia's News Media Bargaining Charge Bill 2026 cleared Parliament on Aug. 20, 2026 and took effect a week later, on Aug. 27. It's a tighter version of Australia's original 2021 news bargaining code, which relied on platforms voluntarily striking deals to avoid being formally "designated" under the law. The new bill sets a hard default: any social media or search platform earning more than A$250 million in Australian digital ad revenue now has to strike commercial deals with at least eight separate news companies, or pay a 2.75% levy on that Australian ad revenue instead.[1][2]

That 2.75% rate is higher than the 2.5% originally proposed when the bill was drafted, meaning the number moved up, not down, during the legislative process. Levies aimed at powerful platforms usually get negotiated lower before passage, not raised.[1][3]

The "at least eight publishers" requirement matters most long-term. It stops a platform from satisfying the law with one large, convenient deal with a single major publisher and calling it compliance. Spreading required deals across eight or more companies pushes bargaining leverage down to mid-size and regional Australian outlets, not just the national players with the leverage to get a seat at the table on their own.[2][3]

Mi3 → Mumbrella → Parliament of Australia (official) →

Data Centers — United States

California Signs the Country's Most Detailed Data-Center Law

Gov. Gavin Newsom signed seven bills on Sept. 21, AB 1577, 2383, 2469, and 2619, plus SB 886, 887, and 1168, building a state data-center registry, mandatory water-use disclosure at the permitting stage, and new environmental review requirements under the California Environmental Quality Act. Together they form the most detailed state-level data-center regulatory package in the country.[1][2]

The registry requirement is the piece most likely to matter beyond California. Right now, most states have no central record of where data centers are, how much water they draw, or how much electricity demand they add to the grid. A public registry turns that into information regulators, journalists, and residents can actually access, rather than something utilities and developers control the disclosure of on their own timeline.[2][3]

The bills also target a specific cost-shifting pattern that's been showing up nationally: utilities proposing grid upgrades to handle new AI data-center demand, then spreading those costs across all ratepayers, including households with no data center anywhere near them. California's package is built to stop AI facilities' grid costs from landing on ordinary electricity bills. Whether other states follow California's model, or whether the tech industry pushes for a lighter federal standard instead to avoid a fifty-state patchwork, is the question this sets up next.[1][3]

Office of Gov. Newsom (official) → CalMatters → Lawyer Monthly →

— End of Issue No. 5 —

Back to the archive →