Week of 14 September 2026
OpenAI published a framework on 16 September 2026 for tracking, investigating, and disclosing model-misalignment incidents.
Key points
- The framework favours early disclosure before investigations are complete, with structured notices for larger cases - a transparency precedent other developers may adopt.
- Six contemporaneous incident reports accompany the framework; these are OpenAI's own self-disclosures, not independently verified accounts.
Cohere CEO Aidan Gomez argues AI safety standards should emerge from public, international processes rather than industry self-regulation.
Key points
- The debate directly concerns who sets AI safety rules - a question with procurement and governance implications for Australian agencies.
- This is a corporate policy position, not enacted regulation; the underlying governance design question remains unresolved.
Bipartisan US bill directs NIST to develop standards for discovering, monitoring, and controlling AI agents in organisational networks.
Key points
- Federal procurement is the proposed enforcement mechanism, potentially binding government AI contractors to agent governance controls.
- This is a bill introduced on 9 September 2026, not yet law - Australian agencies face no immediate compliance obligation.
California Governor Newsom issued an executive order accelerating AI oversight laws and opening a two-month review of frontier-model safeguards.
Key points
- A proposed 'kill switch' mandate remains under evaluation only - no technical architecture, authority, or enforcement mechanism has been defined yet.
- Independent audit regimes of this kind typically increase demand for reproducible evaluations, deployment logs, and tested incident-response procedures.
Microsoft AI published a draft Code of Conduct for MAI models on 14 September, opening a six-week public consultation.
Key points
- The document proposes human-control commitments, absolute harm limits, and behavioral constraints - but is not binding regulation.
- APS relevance is indirect; useful context for agencies evaluating vendor AI governance claims or procurement due diligence.
The EU AI Board's ninth meeting covered AI Act enforcement, AI literacy recommendations, and cybersecurity-AI intersection.
Key points
- Transparency obligations under the AI Act became applicable on 2 August 2026, with supporting Code of Practice and guidelines published.
- Limited direct Australian operational impact; useful as a signal of EU AI Act implementation trajectory.
South Korea, OECD, and ADB convened 80 experts from 25 Asia-Pacific countries to discuss AI-driven official statistics.
Key points
- The workshop centres on SDMX, a global standard for exchanging statistical data and metadata across systems and borders.
- No binding policy, dataset release, or specific AI pilots were announced - limited immediate actionability for APS readers.
Oxford University Press updated author and editor AI disclosure guidance on 10 September 2026.
Key points
- A survey of 2,600+ researchers found 74% unclear on what AI use to disclose - a documented gap in research practice.
- Limited direct relevance to APS governance frameworks; most applicable to APS staff publishing academic or policy research.
Week of 7 September 2026
Anthropic CEO Dario Amodei published an essay urging AI firms to slow frontier capability gains while safety catches up.
Key points
- Amodei's most concrete commitment is permanent, employee-like access for independent evaluators to Anthropic's models.
- Governance gaps remain: evaluator selection, disclosure obligations, testing standards, and enforcement mechanisms are all unspecified.
Week of 31 August 2026
EMVCo released a draft agentic payments framework on 1 September, open for public feedback until 30 September 2026.
Key points
- The proposed Intent Services layer would standardise how AI agents record and share consumer-authorised payment intent across participants.
- This is a consultation document, not a binding standard; limited direct relevance to APS agencies unless they handle payment systems.
The US Society of Professional Journalists proposed ethics-code revisions addressing AI use in journalism on 10 August 2026.
Key points
- The voluntary code update adds guidance on verification, transparency, misinformation, and AI-assisted workflows - not binding law.
- Limited direct relevance to APS AI governance; may have peripheral interest for government communications or media policy teams.
Week of 24 August 2026
A community project maps four minimum viable agent incident-response controls to NIST CSF 2.0 functions, including a kill-switch contract.
Key points
- The specification addresses containment of agents acting with valid credentials - a gap conventional identity controls cannot close alone.
- No implementation results, adoption data, or independent validation are reported in available sources.
Week of 17 August 2026
NIST has released a draft guide showing how AI tools and prompts can support CSF 2.0 cybersecurity analysis.
Key points
- Three use cases cover policy review, current-state profiling, and target-state planning using generative AI prompts.
- Comment period closes 15 October 2026; Australian agencies may track this as a practical AI-for-cyber reference.
Debian developers are voting on eight proposals governing LLM-assisted contributions, from outright bans to conditional acceptance.
Key points
- Proposals centre on accountability, disclosure, provenance, licensing, and restrictions on sending sensitive data to external AI services.
- Limited direct APS relevance; most applicable to open-source software teams or agencies with OSS contribution policies.
Week of 10 August 2026
Anthropic has deployed invisible text watermarks and C2PA-based signed metadata across supported Claude outputs globally.
Key points
- The rollout is tied to EU AI Act Article 50(2) transparency commitments, but marking applies worldwide including via AWS, Google Cloud, and Microsoft Foundry.
- Detection specifications remain unpublished, limiting independent verification of watermark robustness for now.
NAIC's 12-state AI Risk Evaluation Supplement pilot continues through September, informing a structured insurer examination framework.
Key points
- The supplement covers AI inventories, governance controls, validation, monitoring, vendor oversight, and consumer-impact records - a concrete evidence template.
- This is a US insurance-sector development; no direct Australian regulatory parallel exists yet, but the evidence-request model is transferable.
Week of 3 August 2026
The Linux Foundation has opened an RFC for SAFE, a proposed cross-industry AI incident and near-miss reporting exchange.
Key points
- SAFE is still a draft proposal with uncertain adoption - not yet an operating or mandated reporting standard.
- Australian agencies developing AI incident management frameworks could use this draft as a concrete reference point.
Red Hat launched asago, an open-source project linking AI governance policy text to risk tests and deployment controls.
Key points
- The planned workflow maps policies to NIST AI RMF, OWASP LLM Top 10, and EU AI Act via IBM's AI Risk Atlas.
- Asago is in formation phase only - no production release, timeline, or independent validation has been announced.
The Open Secure AI Alliance has released a draft RFC for SAFE, a confidential AI security incident-sharing framework.
Key points
- SAFE proposes structured notification timelines and evidence-preservation requirements across the full AI-agent stack.
- This remains a voluntary draft for community comment, not an adopted standard or enforceable requirement.
The fourth GPAI Signatory Taskforce meeting addressed Safety and Security and Copyright chapters of the GPAI Code of Practice.
Key points
- Post-market monitoring via model usage analysis was highlighted as key to systemic risk assessment under EU AI Act obligations.
- Discussion of 'marginal-risk' clauses - where providers may match unsafe competitor deployments - raised significant AI safety governance concerns.
URAC awarded its first Health Care AI Accreditations to three US organisations in July–August 2026.
Key points
- The voluntary program covers AI governance, risk management, transparency, and monitoring across developer and user roles.
- Limited direct relevance to Australian federal agencies; useful as a sector-specific third-party assurance model to watch.
Zhejiang province's group standard T/ZIESCDA 010-2026 formalises terminology for AI-enabled one-person companies, effective 1 August 2026.
Key points
- The standard defines AI OPCs as founder-led, up to 10 employees, with intelligent agents as a core productivity source across 27 terms.
- Limited direct relevance to Australian federal agencies - useful context on how jurisdictions are beginning to classify AI-agent business models.
NIST NCCoE is hosting an August 2026 webinar on mobile driver's licences for citizen-to-government identity verification.
Key points
- A reference architecture developed with Login.gov (GSA) will demonstrate cryptographically verified mDL-based identity processes.
- Limited direct relevance to APS AI governance work; this is a US digital identity standards item, not an AI item.
Week of 27 July 2026
OECD AI Wonk Blog publishes a five-step roadmap aimed at closing the AI evaluation gap.
Key points
- Framed around strengthening trust, security, adoption, and effective AI governance - directly relevant to APS evaluation work.
- Extracted text is a stub only; full roadmap content is not available for detailed assessment.
The EU AI Omnibus entered into force on 27 July 2026, amending the AI Act's compliance timelines and administrative requirements.
Key points
- High-risk AI system obligations are now deferred: Annex III applies from December 2027, Annex I from August 2028.
- New prohibitions on non-consensual nudification AI and expanded AI Office enforcement powers are also introduced.