Issue No. 6 · Week of September 28–October 4, 2026

No One Agreed on the Rules. Everyone Built Their Own Anyway.

By Rowa Taha

This week's stories aren't about AI doing something new. They're about who gets to decide what happens next: a White House pact with no enforcement, a G20 accord with no teeth, a brand-new EU industrial program, a brand-new African agency, and the quieter fights over labor, data and security happening underneath all of it.

AI Governance — Global / United States

Trump Signs a "Superintelligence" Order. Six AI Companies Sign a Pact With No Penalties Attached.

On September 29, President Trump signed an executive order instructing every federal agency to stop using the term "artificial intelligence" in official communication and start using "Super Intelligence" instead. The order covers correspondence, public statements, websites, reports and policy documents going forward, though it exempts regulations, contracts and historical records already on the books. It also gives the president's science and technology adviser 60 days to draft legislative language defining what "super intelligence" actually means, including whether the new term should replace the legal definition of AI entirely or sit alongside it.[1][2]

The same day, six companies signed a separate, voluntary accord at the White House: Google's Sundar Pichai, Anthropic's Dario Amodei, Meta's Mark Zuckerberg, OpenAI president Greg Brockman, Nvidia's Jensen Huang and Elon Musk. The document asks signatories to adopt four layers of internal safety review: controls built into the model itself, an internal oversight team, an outside evaluator, and a board-level committee that reviews safety reports before they're finalized. Trump called the pact "morally binding" and said it was "almost like a constitution" for the industry.[3]

That description does more work than the document itself. A morally binding agreement is not a legally binding one. The accord sets no statutory penalties for a company that signs it and later ignores its own safety review, requires no public reporting to a regulator, and gives no government body enforcement power if a signatory falls short. It is, in substance, a set of four promises these companies are making to each other and to the public, with no external mechanism to check whether they're kept. Renaming "AI" to "Super Intelligence" across the federal government is a stranger move than it first appears, and its practical effect is still unclear: the order changes the vocabulary agencies use, while a separate 60-day clock runs to figure out whether that vocabulary should eventually carry legal weight. Until that language exists, the order is mostly symbolic. For now, the honor system is still the system.[1]

Nextgov/FCW → GovConWire → MercoPress →

AI Governance — Global / G20

The G20 Just Agreed AI Shouldn't Get Its Own Regulator

All 20 members of the G20, including China and Russia, unanimously endorsed something called the "Carolina Principles" at a summit in North Carolina on September 2. The principles are non-binding, and their core idea is narrow: AI should be governed through existing sector-specific regulators, the kind that already oversee banking, healthcare or transportation, rather than through a single new dedicated AI regulator built from scratch. The accord also encourages closer cooperation between governments and industry on vetting new technology before it reaches the public.[1][2]

That a body spanning the United States, China, the European Union, Russia, India and Brazil reached unanimous agreement on anything AI-related is notable on its own. These countries disagree sharply on nearly everything else touching artificial intelligence: how fast to deploy it, how much data companies should collect, how heavily to tax or subsidize AI infrastructure. Getting all 20 to sign the same document suggests the "no new regulator" position was the lowest-friction option on the table, not necessarily the best one. The timing matters too. The summit happened weeks before Xi Jinping is expected to meet Trump in Washington, and a shared G20 position on light-touch AI governance gives both sides one less point of friction to navigate when they do.[3]

The accord is formally non-binding, and several members already have conflicting domestic frameworks in motion. The EU's AI Act created exactly the kind of dedicated oversight body the Carolina Principles argue against. South Korea's AI Basic Act and China's own rules for generative AI each carve out AI-specific obligations too. So the practical effect, for now, is closer to a stated preference than a binding commitment. The principles are set for formal adoption at December's G20 leaders summit in Florida, which gives member countries roughly three months to decide whether September's endorsement becomes December's ratification, or quietly fades the way plenty of G20 communiqués do once the cameras leave.[1]

Bloomberg → Business Standard → Techstrong.ai →

Industrial Policy — European Union

19 EU Countries Just Designed Their First Joint AI Project

On September 16, the European Commission welcomed the design of the EU's first Important Project of Common European Interest in artificial intelligence, a mechanism normally reserved for large industrial efforts the bloc considers too important, too expensive or too technically ambitious for any single member state to pursue alone. Nineteen countries signed on, coordinated at the European level by Germany's Federal Ministry for Economic Affairs and Energy. The project, known as IPCEI-AI, is built to cover the entire AI stack at once: compute infrastructure, underlying models, and the industrial products and services built on top of them, under one coordinated program instead of 19 separate national efforts.[1][2]

More than 150 individual projects have already been selected across the participating countries, with a combined expected investment above €10 billion. Eleven of the 19 countries began formally pre-notifying their state aid plans to Brussels in September, the procedural step that lets a national government legally funnel public money into a joint European project without running afoul of the EU's rules against state aid distorting competition. The other eight are expected to follow in the coming months.[3]

What makes this worth watching isn't the money, though €10 billion is real money. It's the bet underneath it: that Europe's best chance at AI competitiveness is building shared infrastructure collectively, rather than each country racing alone against the deeper capital behind AI efforts in the US and China. It also sits in tension with the EU's own regulatory posture. Brussels has spent the past two years building the AI Act, the world's most detailed AI-specific framework, with its AI Office now holding real enforcement power as of August. IPCEI-AI is the EU simultaneously trying to accelerate the industry it regulates most aggressively. Whether those two efforts reinforce each other or work against each other is the real question, and it won't have an answer until actual projects start shipping something.[1]

European Commission (official) → MLex → Agence Europe →

Internet Freedom — Global

The UN Counted 300 Internet Shutdowns in Two Years. The Pace Hasn't Slowed.

UNESCO and other UN bodies have renewed warnings this year that government-ordered internet shutdowns are becoming a routine response to political unrest rather than a last resort. Monitoring groups, including the civil society coalition Access Now through its #KeepItOn initiative, have documented at least 300 shutdown incidents across more than 54 countries over the past two years, the worst stretch since tracking began in 2016. A shutdown, in this context, usually means a government ordering telecom providers within its borders to cut or sharply throttle connectivity, often timed to a protest, an election, or civil unrest.[1][2]

Iran imposed a near-total nationwide blackout in January during renewed protests. Afghanistan's Taliban government ordered a nationwide shutdown in the fall of 2025. Nepal suspended access to 26 separate social media and messaging platforms in September 2025 amid political unrest. Cameroon and Tanzania both saw significant connectivity disruption around their own elections. The UN's concern is less about any single incident and more about the trend line: internet access has become central enough to how people organize and verify information that cutting it off during exactly the moments when accurate information matters most functions as a tool of control, not a neutral technical decision.[3]

What's notable is how little international pressure has actually slowed this down. There is no binding global rule against government-ordered shutdowns, and the UN's own authority here is limited to monitoring and public statements rather than enforcement. Access Now and similar groups have spent years building the evidentiary record, country by country, but documentation alone hasn't translated into a cost governments actually weigh before pulling the plug. Shutdowns persist because they work, for the governments ordering them, in the narrow sense of limiting what the outside world sees in the moment it happens. Whether sustained attention eventually changes that calculation is the question this pattern leaves open heading into 2027, a year with at least a dozen national elections already scheduled.[1]

UN Geneva → UN News → AllAfrica →

Labor Rights — Global / 9 Countries

Human Rights Watch Wants a UN Labor Treaty for Gig Workers. The ILO Decides in November.

Human Rights Watch published a report in May documenting how platform companies use algorithmic systems, not human managers, to set pay, assign tasks and discipline workers across nine countries: India, Kenya, Kuwait, Lebanon, Mexico, Pakistan, Saudi Arabia, the United Arab Emirates and the United Kingdom. The report, titled "Algorithms of Exploitation," found a consistent pattern: workers had little to no visibility into how an algorithm decided their pay, almost no meaningful way to appeal a decision once made, and minimal or no occupational injury coverage if hurt on the job.[1][2]

The specifics varied by platform and country, but the throughline was the same. A delivery rider's day-to-day income could shift sharply based on a pricing algorithm the rider had no way to see inside of. An account could be deactivated for an alleged violation with no human reachable to hear an appeal. None of this requires the algorithm to be malicious; it's a structural feature of letting automated systems make consequential decisions about a person's livelihood with no required transparency and no guaranteed appeal path. Human Rights Watch is pushing for a specific remedy: a binding treaty negotiated through the International Labour Organization that would extend baseline protections, pay and task-assignment transparency, a real appeal mechanism, injury coverage, and the right to organize, to gig workers globally.[3]

That push has a real decision point attached. The ILO's governing body meets in November, and one item on the table is whether to formally add platform-work protections to its negotiating agenda, the necessary first step before any binding treaty language can begin. This isn't guaranteed: gig-economy companies have consistently opposed treating their workers as covered by standard labor law, arguing the flexibility that makes platform work attractive would disappear under traditional employment rules. If November adds the item, actual negotiations would still take years. If it doesn't, the nine-country findings stay exactly what they are now: a documented harm with no binding remedy attached.[1]

Business & Human Rights Resource Centre → JURIST → Self Employed →

Legislation — United States

California Bans AI-Only Firing Decisions

Governor Gavin Newsom signed the "No Robo Bosses Act," known formally as SB 947, on September 30, making California the first state to bar employers from firing or disciplining a worker based solely on an algorithm's decision. State senator Jerry McNerney had introduced a nearly identical version the year before; Newsom vetoed that one in October 2025, calling it overly broad. The version he signed this year survived that objection. If an employer relies on an automated decision system to inform a firing or discipline decision, a human being now has to review and verify the outcome first, drawing on more than just the system's own output, including personnel files, manager evaluations and peer feedback.[1][2]

The bill goes further than just requiring review. It separately bans employers from using predictive-analytics tools that claim to forecast a worker's future performance, turnover risk, or likelihood of misconduct, a category of product that has grown quickly as companies market AI tools meant to flag "problem" employees before any actual problem occurs. California's law targets that forward-looking prediction itself, not just the final decision built on top of it. Workers also gain two specific rights: to be told when an automated system was used in a decision affecting their employment, and to request the data the system relied on, independent of whether they end up disputing the decision at all.[3]

The law becomes operative July 1, 2027, giving employers roughly nine months to build human-review processes and documentation trails. It was signed alongside a broader package of 13 AI-related bills Newsom approved in the same batch, reflecting how much of California's 2026 session on AI policy clustered around workplace uses specifically, rather than the more commonly covered territory of AI safety or consumer privacy. Whether other states follow California's human-review model, or write something looser, is the next fight state legislatures are likely to have over it.[1]

AIWeekly → Fisher Phillips → TechRadar Pro →

Data Rights — Brazil

Brazil Fines TikTok $30 Million Over a Feed Kids Could Reach Without Registering

Brazil's data protection authority, ANPD, fined ByteDance, TikTok's parent company, R$153.7 million, roughly $29.9 million, on August 25 for violating the country's general data protection law, the LGPD, in how the platform handled children's and teenagers' personal data. The sanction, the largest the agency has issued since it was created, centers on a feature most users probably never think of as a loophole: the ability to browse TikTok's main feed without creating an account at all, letting anyone, including children well under any age-verification threshold, have their viewing activity collected without consent.[1][2]

ANPD's investigation identified five separate LGPD violations connected to the issue: the unregistered feed itself, weak age verification for users who did register, and the absence of meaningful parental controls. The fine comes with mandatory corrective steps. ByteDance has committed to automatically applying stricter default privacy settings to accounts belonging to users under 16, building out real parental supervision tools, and tightening content filters for younger users. TikTok must also delete data collected from unauthorized 13-to-18-year-old users within 60 business days, or face an additional daily fine for each day it misses that deadline.[3]

What makes this worth tracking beyond the number is the mechanism ANPD targeted. Most children's-data enforcement focuses on registered accounts: weak verification at sign-up, data collected after a profile is created. Brazil's action instead went after data collected from people who never registered at all, treating passive viewing on an open feed as collection requiring the same protections as anything gathered through an account. If other regulators adopt that framing, platforms that have treated unregistered browsing as outside children's-privacy law may find that assumption doesn't hold. Brazil's ANPD, still young compared to Europe's data authorities, just issued its biggest fine yet on a theory of liability other countries haven't widely tested.[1]

Daniel Law → IAPP → CADE Project →

Accountability — Japan

22 Days Late: Japan Disciplines KDDI Over How It Handled a 12-Million-Person Breach

KDDI, one of Japan's largest telecommunications companies, disclosed in June that a cyberattack on an email platform it operates exposed roughly 12.23 million customer email addresses and 7.6 million passwords. The attack hit an email system used by six separate internet service providers that rely on KDDI's infrastructure: STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty and BIGLOBE. Attackers got in by exploiting a vulnerability in third-party software the platform relied on, not through any weakness in KDDI's own core network.[1][2]

After completing its forensic investigation, KDDI submitted a formal report to Japan's communications ministry, and the ministry responded with administrative guidance in August rather than a fine, a formal rebuke with real weight attached even without a monetary penalty. The ministry concluded the breach constituted an unlawful leak of communications secrecy under Japanese law, citing weak password management and, separately, a 22-day gap between when KDDI first detected the unauthorized access and when it fully disclosed the scale of the exposure. KDDI says it hasn't confirmed any secondary damage from the breach, but 22 days is also 22 days during which affected customers had no way to know they should change a potentially compromised password.[3]

As part of the guidance, KDDI must now report its progress on preventing a recurrence every quarter for at least a year, turning what might have been a one-time penalty into sustained oversight. Japan's privacy regulator issued its own criticism alongside the ministry's guidance, faulting KDDI specifically for not containing the damage quickly enough once the breach was found, a distinct complaint from the disclosure-timing issue the ministry focused on. The bigger question the case raises is about speed, not detection. KDDI found the breach. The quarterly reporting requirement exists because regulators weren't convinced the company moved fast enough once it had.[1]

The Record → MLex → Japan Times →

Data Rights — Pakistan

Pakistan Sets Baseline Security Rules for Everyone's Data, With a 90-Day Deadline

Pakistan's federal cabinet approved the Pakistan Information Security Framework 2026 in August, establishing baseline cybersecurity requirements for government organizations, data centers, web hosting providers, software developers and email providers operating in the country. The framework was developed by Pakistan's National Computer Emergency Response Team under authority granted by the 2023 CERT Rules, giving it a clearer legal foundation than earlier, more informal security guidance the government had issued.[1][2]

The cabinet's approval came with a concrete deadline attached. Covered entities have 90 days from approval to identify and fix their most significant security gaps, and the framework requires an independent third-party audit to verify that work actually happened, rather than relying on self-certification. That window puts the compliance deadline squarely in the current news cycle, even though the underlying approval happened in August. The framework itself is deliberately baseline-level rather than sector-specific, setting minimum controls meant to apply broadly from a government ministry to a private web host, rather than detailed rules tailored to each sector's particular risks.[3]

Context matters here too. Pakistan has separately been amending its cybercrime laws, and digital rights organizations have warned those amendments could be used to target journalists and government critics rather than genuine cybercrime. The two efforts are legally distinct, one sets technical security standards, the other defines criminal offenses related to online conduct, but they're moving through Pakistan's government at roughly the same time. Whether the 90-day deadline produces real security improvements, or mostly compliance paperwork ahead of audits that may or may not be rigorously enforced, depends on how seriously the CERT follows through once the clock runs out.[1]

TechJuice → ProPakistani → European Times →

AI Governance — Rwanda

Rwanda Just Created Its First Agency Dedicated Entirely to AI

Rwanda's cabinet, chaired by President Paul Kagame, approved the creation of a National Artificial Intelligence Agency on June 8, the country's first institution built solely around artificial intelligence rather than treating AI policy as one responsibility among many inside an existing ministry. The new agency's mandate spans the full lifecycle of AI policy: research and workforce skills development, ethical standards, support for industry growth, and international partnerships, all under one dedicated body. It builds on Rwanda's National AI Policy, adopted in 2023, and connects to existing programs including the Rwanda AI Scaling Hub, backed by roughly 25 billion Rwandan francs from partners including the Bill and Melinda Gates Foundation.[1][2]

Rwanda is a small country making a deliberately outsized bet on artificial intelligence as an economic development strategy, following a pattern it has used before with other technology sectors: position itself early and aggressively as a regional hub, build supportive policy ahead of demand, and use that early positioning to attract investment and talent that might otherwise bypass a country its size. The timing places Rwanda alongside a broader wave of African governments standing up dedicated AI institutions this year, rather than continuing to govern AI policy through existing data-protection regulators the way most African countries still do. A regional report published earlier this year found that of roughly 45 African countries with data protection laws, only 16 have adopted a national AI strategy at all, and fewer still have built a dedicated agency to execute one.[3]

Local commentary following the cabinet's approval has been cautiously supportive, noting the agency's creation is well-timed given how quickly AI investment and policy attention are moving globally, while also flagging that an agency's real test isn't its founding announcement but what it actually delivers once operational. Rwanda has a credible track record of following through on ambitious tech-sector positioning before, which is part of why the announcement is being taken seriously. Whether the National AI Agency becomes a genuine coordinating body with teeth, or another well-intentioned office competing for resources inside an already-stretched government, is the question its first year in operation will answer.[1]

The New Times (Rwanda) → KT Press → Ecofin Agency →

— End of Issue No. 6 —

Back to the archive →