AI Regulation Tracker

A useful regulatory review starts with how the system is used. Work through these questions before treating a requirement as applicable.

1. Where is the system used? Consider the people affected, markets served, and locations where data is processed.
2. What is your role? Identify whether you develop the system, deploy it, supply a component, or buy it from a vendor.
3. What does the system do? Describe the decisions, recommendations, communications, data access, and actions involved.
4. What can you demonstrate? Collect the architecture, vendor information, testing records, approvals, and monitoring evidence relevant to that use.

Selected changes to the rules and guidance tracked here. Dates are when each event happened; each entry shows separately when Medoya last verified and updated it.

• October 28, 2026: HTI-5 final rule published. ONC finalized changes to decision-support certification, including removal of specified source-attribute and predictive-DSI risk-management requirements from December 28, 2026. See the HTI-5 entry
• September 11, 2026: CRA manufacturer reporting begins. Reporting duties for actively exploited vulnerabilities and severe security incidents begin for manufacturers within scope. See the Cyber Resilience Act entry
• July 27, 2026: AI Omnibus enters into force. Regulation (EU) 2026/1744 amends the EU AI Act timetable, changing application dates for specified high-risk systems. See the EU AI Act entry

Frameworks and security references can help organize governance and technical assessment. Explore NIST AI RMF, ISO/IEC 42001, OWASP guidance, and MITRE ATLAS, with clear explanations of their role.

This resource provides general information about selected regulations and technical considerations. It is not legal advice or a determination that a particular system complies. Check the linked official sources and obtain advice for your circumstances.

Suggest a correction

Dates can refer to different things: a new obligation, a transition period ending, or a requirement being changed. Open an entry to check the affected audience, exceptions, and enforcement notes. Dates by region: United States · European Union · Canada.

Once applicability is established, technical review can help answer concrete questions about the deployed system. The examples below describe assessment work that may support your wider governance and compliance process.

Medoya reviews AI agent behavior, vendor evidence, and architecture within an agreed technical scope. We document findings, limitations, and practical next steps so your team can decide what to change and what needs further review.