Compliance Watch, week ending 12 November 2026
Artificial intelligence (AI) rules start with the AI companies, and the questions flow down to every business that uses AI. I've put Australia first because those questions will reach you through customers, tenders, insurers and auditors.
🇦🇺 Do this week
Australia plans an AI safety regulator, no start date
The Government announced plans on 10 November 2026 for mandatory AI safety and security protections for frontier AI companies. It will propose a new regulator that would be able to enforce significant penalties. Companies would have to keep security controls across development and deployment, manage serious model risks, allow independent evaluation, notify incidents rapidly and publish safety and security frameworks. Further details will come after consultation.
This week: List every AI tool and AI agent your business uses, including ones staff signed up to themselves, with its owner, the data it can reach and what it can do without a person approving. Customers, tenders and auditors will ask for it first. It's the same record Vissibl keeps current for our customers.
Australian Government media release
🇦🇺 Australia
Australia issues open weight AI guides
Australia, 5 Nov 2026. The Australian Cyber Security Centre (ACSC) published two guides on open weight AI models. Running one gives more control over data but makes its security, monitoring and upkeep yours. They cover checking where a model came from and apply only to organisations running or considering these models.
This week: Ask whoever runs your IT whether any AI model runs on your own systems and who updates it.
🇬🇧 🇪🇺 Europe
United Kingdom plans AI agent controls
United Kingdom, 3 Nov 2026. The government will consult on rules for incidents where operators can't adequately monitor or control AI agents. The intended measures cover monitoring agents' actions, telling affected organisations, keeping evidence of what agents did and ministerial reviews. They would apply only to organisations under the network and information systems (NIS) rules for essential and digital services.
This week: For any AI agent that can act in your systems, confirm you keep a log of what it did and who approved it.
EU AI Act bans and marking duty start 2 Dec
European Union, applies from 2 Dec 2026. New bans cover AI that generates or manipulates realistic intimate or sexually explicit images, video or audio of an identifiable person without explicit consent, and AI that generates child sexual abuse material. Providers of generative AI systems on the market before 2 August 2026 must also mark AI generated output in a machine readable format by that date.
This week: If EU customers see AI generated content from you, ask your AI supplier how its output is marked.
🇺🇸 United States
New York opens its RAISE Portal
New York, 10 Nov 2026. The state's Office of Digital Innovation, Governance, Integrity, and Trust (DIGIT) launched the RAISE Portal. Large frontier AI developers must register by 1 January 2027, then publish safety frameworks and report any critical safety incident within 72 hours. It applies directly only to frontier AI developers.
This week: Ask your main AI providers how they would tell you about a critical incident.
Draft lists attacks on AI agents, comments close 18 Dec
United States, 9 Nov 2026. The National Institute of Standards and Technology (NIST) released a draft on attacks against agentic AI systems and their fixes, open for comment until 18 December 2026. It's written for people who design, deploy and govern AI systems.
This week: Ask whoever runs your AI agents which of the attacks in the draft they have tested for.
🇦🇪 Gulf
Abu Dhabi tests AI compliance checks
United Arab Emirates, 2 Nov 2026. Abu Dhabi Government and OpenAI launched the Machine Readable Government initiative, where AI helps officials with routine compliance assessments and each assessment is traceable to the governing rule. Officials keep accountability for final decisions. The first pilot covers food imports, so food importers are affected first.
This week: If you apply for permits in Abu Dhabi, keep the rule reference for each requirement.
🇮🇳 🇸🇬 India and Singapore
India rates AI driven attacks Critical
India, 4 Nov 2026. India's computer emergency response team (CERT In) rates as Critical an AI assisted attacker that works at machine speed. It struck firms again after they had fixed earlier gaps and timed attacks for holidays and weekends. It applies only to Indian financial services firms.
This week: Check whether any test or staging system can be reached from the internet or shares passwords with live systems.
Singapore advises on personal AI agents
Singapore, 6 Nov 2026. The Cyber Security Agency of Singapore (CSA), the Government Technology Agency (GovTech) and the Infocomm Media Development Authority (IMDA) warn agents can be tricked by hidden instructions in websites, emails or documents. Users stay responsible for what agents do.
This week: Find out which staff have connected an AI agent to work email or files.
Where Vissibl fits
Vissibl does the compliance work for you. It holds the frameworks you're certified to and the regulations you answer to together in one product, including your AI inventory, risk assessments and evidence, and keeps them current as the rules change. You sign off.