Most weeks, AI regulation moves in one place at a time. This week it moved in four, and three of the four land on ordinary businesses, not just AI labs. A state chatbot law with teeth. A federal inquiry into how algorithms set prices and pay. A proposed ban on investing in foreign AI. And a removal order that follows one model into other companies’ products.

Here is what happened, with the dates that matter, and the checks worth running now while the deadlines are still ahead of you.

1. New York signed a chatbot law that can reach the model itself

On October 28, 2026, Governor Hochul signed S.9051B / A.10379C, Chapter 368 of the Laws of 2026. It takes effect January 1, 2027.

The law bars operators from offering minors 12 categories of unsafe AI companion features, including chatbots that pose as human, build emotional dependency, or encourage self-harm. Operators have to offer more than one age verification method, at least one that does not rely only on government ID, and delete age data after use.

Enforcement sits with the Attorney General. Penalties run up to $25,000 per violation, and the remedy list includes disgorgement that can reach the data and any algorithm trained on it. Read that again: the remedy can reach the model itself.

One scope catch matters. On the current reporting, the law can apply to users whose age the company has not confirmed. Until age assurance is in place, the practical compliance surface is every chatbot user in New York.

The check: if your chatbot, support agent, or companion style feature talks to New York users, the age assurance and feature gating plan needs to exist now, not in December. How far the law reaches into general purpose assistants is disputed and untested, so get counsel to confirm scope against the Chapter 368 text for your product.

2. The FTC ordered nine big companies to explain their pricing algorithms

Also on October 28, the FTC issued Section 6(b) orders to Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target, and Walmart. The orders require detailed information on how personal data, including through AI analysis and loyalty programs, is used to set prices for consumers and pay for rideshare and delivery workers. Recipients have 45 days to respond.

Two things to keep straight. This is an information gathering inquiry, not a complaint, and no violation has been alleged against any of the nine. Chairman Ferguson’s line was about scrutiny of opaque methodology, and the orders are how the FTC builds the record.

The check: your company does not need to be on that list to have the same exposure. If an algorithm sets your prices, your discounts, or your contractor pay, write down what data goes in, what the system optimizes for, and where a human can override it. That written record is exactly what these orders demand, and having it ready is the difference between answering from strength and scrambling.

3. Treasury proposed banning investment in any AI system from a country of concern

On October 22, 2026, Treasury released a proposed rule under the COINS Act, the outbound investment law enacted in December 2025. Comments are due December 7, 2026, and final regulations are due by mid March 2027.

The current rules ban or require notice for AI investments based on compute thresholds and end use. The proposal removes those tests for AI. A covered transaction involving a covered foreign person developing any AI system would be prohibited, full stop. It also adds Cuba, Iran, North Korea, Russia, and Venezuela to China, Hong Kong, and Macau as countries of concern, and adds sectors including high performance computing and biotechnology.

This is a proposal, not law. The existing rules at 31 CFR Part 850 still govern today. But note the enforcement weather: Treasury recently imposed its first penalty under the current program, $200,000 on Amidi, LLC, over an unnotified investment in an embodied AI company. Under the proposal, that same fact pattern becomes a prohibited transaction instead of a missed filing.

The check: if your company, your fund, or your clients touch cross border AI investment or joint ventures, screen the pipeline against the proposed scope now. The diligence question changes from “does this model cross a compute threshold” to “does the counterparty develop AI at all.”

4. DHS ordered DeepSeek out of federal systems, including products built on it

DHS Exclusion and Removal Order 2026-01 was signed July 24, 2026 and published in the Federal Register on October 20, 2026. It excludes products and services developed by Hangzhou DeepSeek Artificial Intelligence and its affiliates from federal civilian procurement, and it requires removal of DeepSeek products from civilian agency systems.

The part that travels: the order also covers third party products and services developed using DeepSeek implementations. The order does not define that phrase, and it binds federal civilian agencies directly, not private companies.

The check: model provenance is a supply chain question now. If you sell into federal civilian agencies, or your contracts carry FAR 52.204-30, you need to know whether anything in your stack traces to DeepSeek: a direct API, an aggregator, an agent tool, self hosted weights. Expect the same provenance question to show up in enterprise customer diligence even if you never touch a federal contract.

What to do this week

1. Chatbots: list every customer facing chatbot or agent you run, mark which ones can reach New York users, and start the age assurance plan. January 1 is the deadline.
2. Pricing and pay: write the one page explainer for any algorithm that sets prices or pay. Data in, goal, human override. File it where you can find it.
3. Deals: screen any live AI investment or partnership with a country of concern connection against the COINS proposal before December 7, while comments are still open.
4. Stack inventory: list the models under every AI tool you use, including the ones inside other vendors’ products. Provenance questions are coming from regulators and customers alike.

The pattern across all four: regulators are building the record first. Orders, proposals, and inventories come before fines. The companies that keep records as they go are the ones who answer well when the questions arrive.

This article is analysis of public sources, not legal advice. Items flagged above as disputed or proposed should be confirmed with qualified counsel before you act on them.

Start here

The templates I use with clients at Combs Intelligence Group, AI policy, vendor register, approval workflow, and review logs, are packaged here:

The AI Governance Starter Kit, $197

FAQ

When does the New York chatbot law take effect?

January 1, 2027. It was signed October 28, 2026 as Chapter 368. The Attorney General still has to issue implementing regulations, so the plan comes first and the details get confirmed against those rules.

Did the FTC accuse the nine companies of breaking the law?

No. The October 28 orders are a Section 6(b) information inquiry. No complaint was filed and no violation was alleged. The companies have 45 days from receipt to respond.

Is the Treasury COINS proposal law yet?

No. It is a notice of proposed rulemaking released October 22, 2026. Comments close December 7, 2026, the current outbound investment rules still apply, and final regulations are due by mid March 2027.

Does the DeepSeek order apply to my company directly?

Only if you are a federal civilian agency or in its supply chain. The order binds civilian executive agencies. Private companies feel it through federal contracts and through the provenance questions customers are now asking vendors.