AI POLICY NEWS
G20 Backs Flexible AI Regulation but Leaves Copyright Divide Unresolved
G20 governments agreed that new AI regulation should focus on problems existing laws cannot address. Meeting in Chapel Hill, North Carolina, their innovation ministers said existing sector rules should govern AI where appropriate, that each country keeps sovereignty over its own approach, and that consumers should determine through market competition which models best meet their needs.
Governments with very different AI regimes, including China, the EU, India and Brazil, accepted that baseline. For public-sector AI, they backed testing specific uses, measuring results and scaling what works. They also acknowledged the G20 AI Principles, while setting out a more detailed approach to AI regulation and public-sector deployment.
On copyright, the ministers stopped short of adopting a common rule for AI training. They recognized both prior and express consent and copyright exceptions, but left their application to national legal processes. Reuters reported that US Commerce Secretary Howard Lutnick urged them to allow training on creators' work under fair use. The joint statement did not adopt that position.
The US government pressed the same argument at home. In the New York Times suit against OpenAI, the Justice Department argued that training is "exceedingly transformative" and that requiring paid licenses would hamper innovation and disadvantage US AI companies. The Times said the administration had sided with trillion-dollar companies over creators.
Brazil Limits Its Deepfake Ban and Locks Voting Software Ahead of the 2026 Election
One month before Brazil votes, its highest electoral court ruled that the deepfake ban covers only content that qualifies as campaign propaganda. The ruling rejected a challenge to a video shown at the Liberal Party convention in July, in which AI recreated the image and voice of former President Jair Bolsonaro endorsing his son for president.
The former president is barred from speaking publicly. A left-wing coalition sought a fine against the son, Flávio Bolsonaro. The court held that an endorsement before party delegates is not a request for votes, and that streaming the convention did not by itself make it early campaigning. Judges must weigh a message's content, language, audience and context.
Brazil votes on electronic ballot boxes. Their source code was open for inspection throughout the election cycle, and was examined by political parties, prosecutors and other oversight bodies. On September 4 the court locked the systems so they can no longer be altered, and published identifiers that let the versions in use be checked against those inspected.
For most voters, identity is checked twice. Everyone presents photo identification, and for the 141.3 million of 158.7 million voters with biometrics on file, the ballot box then reads a fingerprint. Neither a missing record nor a failed read stops anyone voting. The rules require poll workers to confirm identity another way.
The EU Brings ChatGPT Under Its Online Safety Law as a Search Engine
The European Commission has placed ChatGPT under the Digital Services Act's rules for the largest services, as a very large online search engine. The chatbot can search the web when it answers, which makes it a search engine in law. OpenAI reports 159.1 million monthly EU users, above the law's 45 million threshold.
By January 2027 the company must assess and reduce systemic risks linked to the service and its algorithms: illegal content, harm to minors, harm to physical and mental well-being and fundamental rights, and threats to elections and public security. The Commission gains powers to investigate how it works. Fines can reach six percent of annual worldwide turnover.
Reddit and Roblox were designated very large online platforms the same day, with 57.2 and 46.6 million users. The Commission will supervise ChatGPT with Ireland's media regulator, and the other two with the Dutch consumer authority. More than 20 companies now operate services carrying one of those designations, among them Google, Meta, Microsoft and TikTok.
ChatGPT arrives with more EU users than TikTok or X, and is not the first generative AI tool to draw scrutiny. In January the Commission opened an investigation into X over Grok, its built-in chatbot, saying risks appeared to have materialized in manipulated sexual images, some possibly amounting to child sexual abuse material.
India's Supreme Court Sets Aside a Customs Order Built on Fake Legal Authority
India's Supreme Court has set aside a customs order imposing a 4.25-billion-rupee penalty, about $45 million, because the official relied on cases that do not exist and on real cases made to say what they never said. The case returns to customs for a fresh decision on whether the trader misdeclared natural diamonds as lab-grown ones to obtain a lower tariff.
The Supreme Court did not examine that allegation. Instead, it checked the cases and citations the customs official had relied on. Some cases did not exist. Some citations were false. In other instances, real judgments were cited for holdings they did not contain, which the justices called "a hallucination of AI."
Two months earlier, the court threw out an insolvency decision and the ruling that upheld it after finding the same kinds of fabricated legal authority. Even the smallest amount of fake material, it said, is enough to invalidate a decision, whether or not it changed the outcome. The ruling did not restrict AI itself.
The earlier case came from a tribunal. This one came from a government department, where officials impose penalties before any court sees the file. India's draft rules on AI in adjudication, published in June, cover the courts, tribunals and commissions that decide cases, and set up committees to watch AI use there. Government departments get no such committee.
China Drafts a Five-Level Grading System for AI Security
China's cybersecurity standards committee (TC260) has published a draft national standard that grades how well an organization manages AI security, on five levels across 39 areas of practice. Organizations can assess themselves or be assessed by a third party, and the draft says regulators may use the framework as a reference when evaluating them. It is open for public comment.
Many AI governance frameworks set out what organizations should do. This draft grades how systematically they do it. The 39 areas span the work from collecting data to retiring an application, and each carries five levels, from measures applied case by case to processes the organization improves and then reverifies.
The scale reaches past conventional security. Its criteria include fairness testing, traceable explanations, a person able to take over an interaction, safeguards for minors, and measures against the psychological dependence that AI companions and virtual humans may cause. Not every criterion applies to every area.
Organizations running AI agents are graded on auditing their tool chains, blocking unauthorized tool calls and finding agents holding more permissions than they need. Which areas apply depends on whether an organization supplies data, builds models or provides applications, and its assessment must identify any areas left out and explain why.