LD-12 — Regulation-in-Practice: Rights, Compliance & Developmental Steering
EVIDENCE CUT
25 September 2026
CURRENT SOCIOLENS POSITION
AI regulation is not one regime and cannot be understood from statutory text alone.
The strongest current evidence supports a hybrid, institutionally differentiated picture:
- rights protection is real, but the strongest realized rights evidence still comes from older law such as the GDPR and courts;
- AI-specific regulation currently produces substantial compliance infrastructure: codes, governance teams, audits, standards work, information requests and regulator build-out;
- states also use AI policy to organize markets and technological capacity through procurement, filing systems, litigation, funding conditions and national model programmes;
- which function dominates depends on the instrument, its legal stage, the implementing institution and the jurisdiction.
The best-supported overall position is therefore:
HYBRID / INSTITUTIONALLY DIFFERENTIATED REGULATION.
THE QUESTION
What does AI regulation become after legislation is announced or enacted?
A useful answer requires separating:
proposal;
enactment;
entry into force;
application;
implementation;
enforcement;
sanction;
remedy use;
organizational compliance;
procurement;
deployment;
and measured outcome.
IN FORCE ≠ APPLICABLE ≠ ENFORCEABLE.
1. THE EU AI ACT IS ALREADY OPERATING — BUT NOT ALL AT ONCE
The EU AI Act is in force.
But major high-risk obligations now apply later:
- Annex III high-risk systems: December 2027;
- product-embedded Annex I high-risk systems: August 2028.
Other parts of the regime are further along.
General-purpose AI obligations and Commission enforcement powers have already entered their applicable phases, while transparency obligations also apply.
So “the AI Act applies” and “the high-risk regime is not yet applicable” can both be correct.
The relevant question is: which obligation, at what stage?
2. NATIONAL ENFORCEMENT INFRASTRUCTURE IS STILL BEING BUILT
FACT — ADMINISTRATIVE RECORD.
On the European Commission's September 2026 list:
- 9 Member States had a final market-surveillance single point of contact;
- 12 were pending final adoption;
- 6 had no authority listed.
That does not mean the six states have no regulators or that the nine final authorities have sufficient staff.
It means the AI Act's dedicated market-surveillance architecture was still incomplete more than a year after the designation deadline.
MANDATE ≠ CAPACITY.
3. VOLUNTARY CODES CAN STILL BE PART OF REGULATION
The General-Purpose AI Code of Practice is voluntary.
But Commission guidance recognizes adherence as one route through which providers can demonstrate compliance.
Providers that do not sign must demonstrate compliance through other adequate means.
This is why “voluntary” does not mean “outside regulation.”
The Code sits inside a binding supervisory system.
What R08 does not establish is whether Code adherence actually reduces model risk.
4. AI OFFICE ENFORCEMENT HAS STARTED — AT THE INFORMATION-GATHERING STAGE
The AI Office has begun using information-request powers.
Specialist reporting attributes to the Commission a first wave involving more than 30 providers, covering safety/security and copyright/transparency topics.
HQ verified the enforcement framework and the start of information-request activity, but did not locate an official Commission publication carrying the exact “more than 30” count.
No AI Office fine or final non-compliance decision was verified by the evidence cut.
This is enforcement activity.
It is not yet evidence of sanction-backed behavioural change.
5. A COMPLIANCE PROFESSION IS FORMING
SURVEY ESTIMATE — INTERESTED INSTITUTIONAL POSITION.
In the 2025 IAPP/Credo AI survey:
- 77% of surveyed organizations said they were working on AI governance;
- the share was close to 90% among organizations already using AI;
- only 10 of 671 respondents expected to need no additional AI-governance staff within a year.
This is evidence of organizational build-out.
It is not evidence that AI governance programmes reduce harm.
The source position matters: IAPP is itself a professional association active in AI-governance training and certification. The survey is not a probability sample of all organizations.
6. NYC: AUDIT LAW CAN PRODUCE PROCEDURE WITHOUT CLEAR ACCOUNTABILITY
PEER-REVIEWED OBSERVATIONAL EVIDENCE.
New York City's Local Law 144 requires bias audits and transparency for covered automated employment decision tools.
In an audit-style study of 391 employers:
- 18 posted audit reports;
- 13 posted transparency notices.
But employers have substantial discretion in deciding whether their systems fall within the law's scope.
That means the low visible numbers cannot simply be converted into a non-compliance rate.
The researchers called this problem “null compliance”:
outsiders may be unable to distinguish lawful non-coverage from failure to comply.
7. NYC: ENFORCEMENT CAPACITY ALSO MATTERS
GOVERNMENT AUDIT.
The New York State Comptroller later concluded that NYC's enforcement system was ineffective.
Its audit found:
- 75% of test calls to 311 were not directed to the responsible department;
- in the same 32-company review, DCWP identified one issue while the auditors identified at least 17 potential instances of non-compliance.
A legal duty can therefore exist while complaint routing and regulator review remain weak.
AUDIT / NOTICE ≠ SUBSTANTIVE RISK REDUCTION.
8. THE STRONGEST REALIZED RIGHTS EVIDENCE COMES FROM THE GDPR
COURT DECISION.
In C-203/22, the Court of Justice of the European Union held that a person affected by automated credit scoring is entitled under the GDPR to meaningful information about the procedure and principles actually applied.
Merely providing a complex formula or algorithm is not enough.
The explanation must allow the person to understand how their personal data affected the result.
This is a meaningful formal right.
But R08 did not locate population-level evidence showing:
- how often people request such explanations;
- how often they obtain them;
- what they cost in time or legal support;
- how often they change an outcome.
FORMAL RIGHT ≠ USABLE REMEDY.
9. JURISDICTION CAN DETERMINE WHETHER ENFORCEMENT SURVIVES
Italy's data-protection authority fined OpenAI €15 million over ChatGPT.
That decision was later annulled by the Court of Rome.
The decisive issue was competence under the GDPR one-stop-shop after OpenAI had established its European base in Ireland.
The court did not decide that the underlying processing was lawful.
This is an important distinction:
AN ENFORCEMENT CASE CAN FAIL ON JURISDICTION WITHOUT RESOLVING THE MERITS.
10. COLORADO: ENACTMENT DOES NOT GUARANTEE IMPLEMENTATION
Colorado enacted a broad AI framework in 2024.
Its operative requirements were delayed.
Before that framework could operate as designed, enforcement was stayed during federal litigation and the legislature replaced the scheme in 2026 with a narrower disclosure/automated-decision framework whose main duties begin in 2027.
This is a clear example of regulatory tempo.
ENACTED ≠ APPLIED.
R08 does not establish that federal pressure caused Colorado's legislative replacement.
11. U.S. FEDERAL POLICY ALSO STEERS THROUGH DEREGULATION
FACT — FEDERAL EXECUTIVE POLICY.
Executive Order 14365 directed:
- creation of a Justice Department AI Litigation Task Force to challenge selected state AI laws;
- federal evaluation of state AI laws;
- conditions affecting eligibility for some non-deployment BEAD funds, to the maximum extent permitted by law.
The Justice Department subsequently established the task force.
The order itself does not automatically preempt state law.
The Executive Order's characterization of selected state laws as burdensome or inconsistent with federal policy is the administration's position. R08 uses the order as evidence of a steering mechanism, not as an independent judgment on the merits of those state laws.
The example matters analytically because state steering is not limited to subsidies or new obligations.
Government can also attempt to organize markets by challenging subnational rules or attaching conditions to funding.
12. CHINA HAS AN OPERATIONAL FILING AND REGISTRATION ARCHITECTURE
GOVERNMENT ADMINISTRATIVE DATA.
China's CAC reported:
- 988 generative-AI services filed and 598 applications/functions registered by the end of June 2026;
- 1,112 services filed and 731 applications/functions registered by the end of August.
The latest two-month period added 124 service filings and 133 application/function registrations.
These are administrative counts.
They are not measures of:
- model quality;
- safety;
- adoption;
- market share;
- or technological capability.
FILED / REGISTERED ≠ CAPABLE / ADOPTED.
13. CHINA ALSO LINKS DOWNSTREAM APPS TO FILED UPSTREAM MODELS
CAC notices require launched generative-AI applications or functions to display the filed or registered service/model they use, including the model name and filing or launch number.
This creates a traceable administrative link between downstream applications and upstream models.
It may organize market structure.
R08 does not establish the size of that market effect.
14. CHINA'S “AI+” NUMBERS ARE TARGETS
PRIMARY POLICY TEXT.
China's State Council set targets for application penetration of new-generation intelligent terminals and AI agents:
- above 70% by 2027;
- above 90% by 2030.
Those are developmental targets.
They are not measured outcomes.
And they should not be silently compared with ordinary “percentage of people using generative AI” statistics, because the construct is different.
TARGET ≠ OUTCOME.
15. SOUTH KOREA COMBINES OBLIGATION WITH PROMOTION
South Korea's AI Basic Act and implementing decree are in force.
The law includes transparency and other duties, along with statutory administrative-fine provisions.
An authoritative U.S. government report describes MSIT as operating an at-least-one-year grace period in which most fact-finding investigations and administrative fines are deferred except in serious-harm cases.
HQ verified the Korean statute and decree in the Korean legal database.
The exact grace-period policy remains government-relayed because HQ did not locate the Korean primary implementation notice.
The important pattern is:
LAW IN FORCE + GUIDANCE-FIRST ENFORCEMENT + ACTIVE INDUSTRIAL SUPPORT.
16. SOUTH KOREA'S SOVEREIGN-MODEL PROGRAMME IS A REAL TOURNAMENT
Primary MSIT releases document a staged public programme.
It began by selecting five teams from fifteen applicants.
Later evaluations progressively narrowed the field.
By the Phase 2 results, three teams advanced:
- Upstage;
- SK Telecom;
- LG AI Research.
The stable fact is not “five teams.”
The stable fact is the tournament structure:
public support, data/compute resources and periodic competitive evaluation.
This is developmental steering.
It does not prove that the programme caused frontier-level capability.
17. EUROPE'S AI GIGAFACTORIES ARE POLICY IN MOTION, NOT OPERATING CAPACITY
The formal EuroHPC call opened in July 2026 and closes in November 2026.
It contemplates up to seven AI Gigafactory facilities/consortia.
The selected consortia are expected to establish and operate facilities from which public contracting parties acquire AI compute access.
At the evidence cut, this is procurement.
It is not deployed sovereign compute.
ANNOUNCED ≠ AUTHORIZED ≠ PROCURED ≠ DEPLOYED ≠ OPERATIONAL.
18. STANDARDS CAN SET REGULATORY TEMPO
EN 18286:2026, a quality-management standard developed to support AI Act implementation, has now been published by CEN/CENELEC.
That supersedes older descriptions of it as only a draft in public enquiry.
But publication of a European standard and legal reference in the Official Journal are separate stages.
The Commission explains that OJEU reference is what gives a harmonised standard the presumption-of-conformity effect under the AI Act.
HQ did not locate an OJEU reference for EN 18286 at the evidence cut.
STANDARD PUBLISHED ≠ OJEU-REFERENCED ≠ PRESUMPTION OF CONFORMITY.
19. FOUR POSITIONS
P1 — RIGHTS REGIME
Supported, but the strongest realized evidence currently comes from GDPR and courts.
AI-specific high-risk remedy effects remain largely future or unmeasured.
P2 — COMPLIANCE INDUSTRY / PROCEDURALIZATION
Strongly supported in the EU/NYC core.
Codes, governance functions, audits, standards and information requests are already visible.
P3 — INDUSTRIAL POLICY / DEVELOPMENTAL STEERING
Strongly supported in China and South Korea.
Present at earlier procurement or market-organization stages in the EU and U.S.
P4 — HYBRID / INSTITUTIONALLY DIFFERENTIATED
Best supported overall.
The same jurisdiction can move between P1, P2 and P3 depending on the instrument and stage.
20. WHO GAINS, WHO BEARS THE BURDEN, WHO CAN CONTEST?
Current distributional evidence is thinner than institutional-process evidence.
What is visible:
- job-seekers bear search and complaint burdens under NYC's disclosure regime;
- legal contestability can require long procedural chains and litigation;
- governance and compliance work creates demand for specialized professional labour;
- selected Korean model consortia receive public resources and evaluation opportunities;
- China's administrative regime privileges products that enter the filing/registration architecture;
- EU compute procurement states intended access for researchers, public authorities, entrepreneurs and SMEs, but realized allocation is not yet known.
What remains weakly measured:
- SME compliance costs;
- incumbent advantage;
- remedy outcomes by class;
- race/ethnicity and gender outcomes beyond audit metrics;
- disability, age, citizenship and language effects;
- union/worker contestation.
These are not minor omissions. They are part of what regulation-in-practice still fails to make visible.
21. WHAT WE DO NOT KNOW YET
R08 does not establish:
- remedy-use rates under GDPR automated-decision rights;
- AI Act complaint volumes and outcomes;
- adequate staffing of national authorities;
- substantive risk reduction from voluntary-code adherence;
- Chinese rejection or sanction rates under the filing regime;
- achievement of China AI+ targets;
- first post-grace Korean enforcement outcomes;
- realized utilization or distribution of EU Gigafactory compute;
- causal product-withholding effects attributable to a specific EU AI law;
- robust SME compliance costs or incumbent advantage.
22. HOW TO READ REGULATORY CLAIMS
For this debate, legal stage is part of the claim.
Do not silently collapse:
proposal into law;
law into application;
application into enforcement;
enforcement into sanction;
right into remedy;
procurement into capacity;
target into outcome.
A changed statute, court decision or implementation deadline must supersede the older state explicitly.
23. WHAT WOULD MOVE THIS DEBATE?
The synthesis would materially change with:
- AI Office or national corrective decisions and sanctions with documented product effects;
- published authority resource/staffing reports;
- remedy-use and remedy-outcome data;
- OJEU reference and adoption evidence for AI standards;
- post-grace Korean enforcement;
- Chinese filing rejection/rectification data;
- measured AI+ target attainment;
- awarded, constructed and used EU Gigafactories;
- causal studies of compliance cost, market entry or withdrawal.
KEY EVIDENCE
- Regulation (EU) 2026/1744 and European Commission implementation material.
- European Commission market-surveillance authority list.
- European Commission GPAI Code/guidelines.
- Wright et al., Null Compliance, FAccT 2024.
- New York State Comptroller Audit 2024-N-6.
- CJEU C-203/22.
- Italian Garante Decision No. 755 and Court of Rome R.G. 4785/2025.
- Colorado General Assembly SB24-205, SB25B-004 and SB26-189.
- U.S. Executive Order 14365 and DOJ AI Litigation Task Force memorandum.
- CAC generative-AI filing notices.
- State Council AI+ Opinion 国发〔2025〕11号.
- Korean AI Basic Act / implementing decree.
- MSIT Sovereign AI Foundation Model programme releases.
- EuroHPC AI Gigafactory call.
- CEN/CENELEC EN 18286 and Commission standardisation guidance.
- IAPP/Credo AI Governance Profession Report 2025.
PAGE STATUS
LIVING DEBATE v0.1 — LOCKED.
Built from R08 HQ-adjudicated canonical claims only.
HOLD-only claims excluded.
Future changes require versioned amendment or explicit supersession.