Written by: Jason Veen
Published:
Issue 1. Published Oct. 14, 2026. 6-minute read.
What Changed in AI Governance, September 29 to October 8, 2026
Your AI governance framework can show what you approved. Two authorities now look at what your AI produced. California's SB 1000, signed on September 30, 2026, moved AI disclosure inside the content, and Australia's conduct regulator, ASIC, said the same day that it expects to begin reviewing customer-facing bank AI before year end. Bank of America's sixteen-dimension intake shows the other side: it assesses systems, not single answers. In our reading, that is where intake stops and these authorities start.
At a Glance
California SB 1000
Statute, state AI disclosure law · California legislature and Governor · Signed Sept. 30, 2026
- Applies to: covered AI providers, not the brands that deploy them.
- What it signals for customer-facing AI: the disclosure travels inside each AI-generated output, where technically feasible.
ASIC AI Review of Banks
Supervisory · ASIC, Australia's conduct regulator · Letter published Sept. 30, 2026; review expected October to December 2026
- Applies to: licensed Australian banks, as a review, not a rule.
- What it signals for customer-facing AI: a record of what each customer was told, throughout deployment.
Bank of America's Sixteen Risk Dimensions
Industry · Bank of America, US · Reported Oct. 2, 2026
- Applies to: Bank of America only.
- What it signals for customer-facing AI: systems are assessed, not single answers.
Super Intelligence Force
Executive · White House, US federal · Reported Oct. 5, 2026; reports in 120 days
- Applies to: no one yet.
- What it signals for customer-facing AI: nothing described.
California SB 1000 Drops the Visible AI Disclosure Option
What happened. Governor Newsom signed SB 1000 on September 30, 2026, amending California's AI Transparency Act. The Assembly committee analysis of the bill as heard on June 16, 2026, records three changes that bear on where proof lives. The act is expanded “to cover all GenAI systems, not only those that have over 1 million monthly visitors or users”. The requirement “that a covered provider offer a user the option to include a manifest disclosure in GenAI content” is deleted. Latent disclosure is kept, carrying the specified information only to the extent “technically feasible”. The enacted text is Chapter 861, Statutes of 2026.
Who it reaches. Covered providers of generative systems, not deploying banks or brands.
The customer-facing system involved. Any generative system producing public content.
Where current controls stop. A manifest disclosure is the visible label a reader sees; a latent one is machine-readable, carried inside the content. The duty to offer the visible label is gone; the embedded one stays. The risk is narrow: an output that should carry the disclosure and does not, which a release check sees and a policy review never does.
Our take. A property of an artifact is set at release, or not at all. If you deploy a provider's system, ask how the embedded disclosure is carried and what confirms it reaches customers.
ASIC's AI Review Puts Customer-Facing Bank AI in Scope
What happened. On September 30, 2026, ASIC published its 2026-27 supervisory priorities and a banking supervisory letter. The review is focused on “new and proposed use cases of AI by banks and the impact on customers”, with expected commencement Q2 2026-27, October to December 2026.
Who it reaches. Licensed Australian banks, as a review. The letter states priorities, not rules, and does not reach banks outside Australia.
The customer-facing system involved. Any bank system generating what a customer receives, usually a chatbot answer already on the record.
Where current controls stop. The review's scope sits partly at the proposal end. The expectation is wider: ASIC says it “is keen to ensure that key consumer protections are maintained throughout its deployment, particularly for customer-facing interactions, decision-making and lending processes.” The exposure is a question a bank may not be able to answer: what this customer was told, and against what standard. Only a record made at the interaction answers it.
Our take. “Throughout its deployment” is a duration and an intake decision is a point, and a point cannot be evidence about a duration. The test for any regulated business: can the program produce the record of one named customer's conversation, not only the approval of the use case?
Bank of America's AI Intake Assesses Sixteen Risk Dimensions
What happened. Bank of America evaluates AI implementations across sixteen risk dimensions, chief technology and information officer Hari Gopalkrishnan said at Fortune's AIQ Summit on October 1, 2026. Privacy, bias, workforce implications and intellectual property are among them, as Fortune reported the next day.
Who it reaches. Bank of America. Nothing here binds anyone else.
The customer-facing system involved. Not specified. One example he gives of what continuous governance has to catch is a chatbot that serves customers with some accents poorly.
Where current controls stop. The sixteen dimensions assess implementations. Gopalkrishnan also describes governance as continuous, including evaluating results and monitoring systems, so the control reaches past intake. Monitoring reports on how a system performs across many customers. A check at release would hold the record of each answer; monitoring shows the trend.
Our take. What Fortune's account does not describe is a record of what one output said, measured against a named standard. We are not claiming it denies one. The question for your own program is whether anything in it would produce that record.
The Pattern
Across this period's customer-facing AI regulation, the division is real, and not tidy. SB 1000 resolves on one artifact. ASIC's expectation resolves on what one customer was told. Bank of America's intake and monitoring resolve on a proposal and a population.
The period's most covered AI regulation news sits outside it. Nextgov reported on October 5, 2026, that Director of National Intelligence Jay Clayton will lead a Super Intelligence Force, reporting in 120 days. Nextgov describes its charter as AI-enabled threats, breach notifications and government response capacity. These documents do not address what a customer-facing system says. The authorities moving on that are conduct regulators and state legislatures, not this one. That is our reading.
The strongest objection is that intake is where risk gets reduced. Catching a bad output at release is late, and at volume expensive. Sixteen dimensions applied before anything is built prevent more harm than checks after. True, and it answers a different question. Intake decides what should exist. It does not produce a record of what any output said. Monitoring produces one about a population; a conduct regulator asks about one customer.
The enterprise stack still lacks a consistent, independent control layer that verifies AI-generated language against the brand's own standard before release.
Where LuxeDetect™ Fits
The standard does not belong to the model, the platform or LuxeDetect™. It belongs to the brand. LuxeDetect™ turns that standard into something enforceable.
LuxeDetect™ is AI Brand Integrity Infrastructure: the independent, deterministic brand-integrity release gate across the enterprise AI stack. LuxeDetect™ is designed to sit between enterprise AI systems and public release. Each in-scope AI-generated or AI-assisted customer-facing output is evaluated against a brand-owned, version-controlled LF1000 Brand Benchmark and either approved, routed for review, or intercepted before release.
The decision is logged against the benchmark version. That log is the audit trail for one answer. LuxeDetect™ does not rewrite what it evaluates, and discharges no obligation under any statute. It replaces neither intake nor a platform safety layer.
On the Radar
October to December 2026. ASIC's banking AI review is expected to commence, per its supervisory letter.
December 10, 2026. Australia's Privacy Act transparency duty for automated decisions begins: privacy policies have to disclose where automated decisions are made. The OAIC has published guidance.
January 1, 2027. State AI disclosure laws keep arriving. Colorado's SB 26-189 takes effect for developers and deployers of automated decision-making technology. The Illinois AI Safety Measures Act also takes effect for frontier model developers, with framework and audit duties from January 1, 2028.
Quick Answers
Does ASIC regulate AI in banking? ASIC is Australia's conduct regulator, and supervises how licensed banks treat customers, including where AI does the treating. It has issued no AI rule. The letter states priorities, not rules.
What does California SB 1000 require? Its duties fall on covered providers of generative systems, not on the enterprises deploying them. A brand using a third-party system takes on no obligation under it. What changes is where the proof sits: the visible disclosure option is deleted and the embedded one kept.
Who checks what AI says to customers? Intake assesses the use case. Platform layers screen for harm. Monitoring reports after the customer has read it. The enterprise stack still lacks a consistent, independent control layer that verifies AI-generated language against the brand's own standard before release.
Issue 2, on October 28, checks whether ASIC's review opened on schedule. The wider question is answered in the guide on what an AI governance framework actually has to cover. For banking, model risk management reaches the assistant, not the answer.
Get the next issue of AI Governance News by email.
AI content risk is not solved after publication; it has to be controlled before release.