The Framework Newsletter 05.19.2026
Enforcement day is here: FTC begins TAKE IT DOWN Act enforcement, Colorado resets its AI law, and Illinois launches a 8-bill AI package. This is the week AI compliance got real.
TL;DR
The week’s defining story is enforcement arriving before federal legislation does. Today, May 19, the FTC officially began enforcing the TAKE IT DOWN Act, the first federal law directly targeting AI-generated deepfakes; placing real compliance obligations on major platforms for the first time. Simultaneously, Colorado Governor Jared Polis signed SB 189 on May 14, formally repealing and replacing the Colorado AI Act with a lighter-touch disclosure framework, effectively resetting the most closely watched state AI experiment in the country. Georgia enacted chatbot disclosure requirements. Illinois launched an eight-bill AI regulation package explicitly modeled on California and New York law. New Jersey filed a new automated decision system disparate impact bill. Abroad, the EU continued rolling out its AI Act Omnibus with an open consultation on transparency guidelines. The week’s throughline: states are moving faster than Congress, and enforcement, not legislation is now the proximate compliance driver for AI companies.
FTC — TAKE IT DOWN Act Enforcement Begins
[Impact Rating: High]
Date: May 19, 2026
The Federal Trade Commission began enforcing the TAKE IT DOWN Act today. The law was signed in May 2025 and requires covered platforms to implement a notice-and-takedown process for nonconsensual intimate imagery (NCII), including AI-generated deepfakes. Upon receiving a valid victim notice, platforms must remove the content within 48 hours and make reasonable efforts to prevent re-upload. FTC Chairman Andrew Ferguson sent warning letters to Meta, Apple, Microsoft, TikTok, Reddit, Snapchat, and X ahead of the deadline, signaling aggressive enforcement intent. Violations are treated as unfair or deceptive trade practices under the FTC Act, with civil penalties up to $53,088 per violation. This is the first federal enforcement mechanism specifically targeting AI-generated non-consensual imagery and it is officially active today.
NIST/CAISI — AI Cybersecurity Framework Profile Targeting Summer Release
[Impact Rating: Medium]
Date: May 2026 (ongoing)
NIST’s Center for AI Standards and Innovation confirmed this week that it is targeting a summer 2026 release for a new AI Cybersecurity Framework Profile — the first NIST guidance specifically designed to address cybersecurity threats against AI systems themselves. Separately, CAISI announced it is conducting pre-release cybersecurity evaluations of frontier AI models from Google, Microsoft, and xAI before their public release. These two efforts represent a significant expansion of NIST’s role from passive standards-setter to active AI system evaluator. Companies building on or deploying frontier models should expect that security posture attestations will become standard practice under future federal procurement and compliance regimes.
H.R. 2152 — AI PLAN Act (Markup, May 13)
[Impact Rating: Medium]
Sponsor: House Financial Services Committee (Bipartisan) | Status: Full Committee Markup | May 13, 2026
The AI PLAN Act (Artificial Intelligence Practices, Logistics, Actions, and Necessities) passed through a full committee markup at House Financial Services on May 13. The bill establishes a structured federal framework for AI governance in the financial sector: covered institutions must build AI oversight programs, run periodic risk assessments, and issue transparency disclosures to customers subject to automated decision-making. The Financial Services markup is an important signal that financial services is emerging as the beachhead for sector-specific AI accountability rules, and a bill advancing through markup has real momentum. AI companies serving banks, lenders, insurers, or payment processors should read this as an imminent compliance horizon, not a distant possibility.
S. 3809 — AI Grand Challenges Act of 2026
[Impact Rating: Low]
Sponsor: Sen. Cory Booker (D-NJ), Sen. Mike Rounds (R-SD), Sen. Martin Heinrich (D-NM) | Status: Referred to Commerce Committee
This bipartisan bill authorizes the National Science Foundation to identify grand challenges in artificial intelligence and award competitive prizes for breakthrough solutions. The model — prize competitions rather than grants — aligns with the current administration’s preference for outcome-driven federal investment. It’s likely to move in a larger innovation bill package rather than as standalone legislation. For AI developers and research institutions, the practical implication is new federal funding pathways for foundational R&D tied to defined public-interest challenges. Worth watching, though it will have no direct regulatory impact on deployed AI products.
S. 3888 — Small Business Artificial Intelligence Training Act of 2026
Sponsor: Bipartisan Senate | Status: Referred to Committee
[Impact Rating: Monitor]
This bill directs the development of accessible AI training resources for small businesses to help them adopt and use artificial intelligence tools without running afoul of emerging regulations. The legislation addresses a genuine structural gap: while large enterprises have dedicated AI governance teams, small businesses often lack the resources to vet AI tools or understand compliance obligations. A federal AI literacy program directed at small business operators could meaningfully reduce adoption barriers and compliance risk for the long tail of the economy — but this bill is at an early stage and likely to be absorbed into a broader competitiveness or workforce package rather than moving independently.
*This is not an exhaustive list of state level filings but a set of bills that we found interesting.
Colorado — SB 26-189: Repeal and Replace the Colorado AI Act (SIGNED INTO LAW)
Signed by Governor Polis | May 14, 2026 | Effective January 1, 2027
[Impact Rating: High]
Colorado Governor Jared Polis signed SB 189 on May 14, formally repealing and replacing the Colorado AI Act, the nation’s most comprehensive state AI law, modeled on the EU AI Act. The original statute faced sustained industry opposition over workability and was delayed multiple times. SB 189 jettisons the duty-of-care, risk management, and impact assessment requirements in favor of a disclosure-based framework with limited consumer rights in defined high-stakes circumstances. The new law takes effect January 1, 2027. Colorado’s reversal is the most significant state AI story of the year: it signals that the EU-style high-risk AI approach has real political limits in the U.S., and will embolden other states to pursue lighter-touch disclosure frameworks. If your compliance strategy was built around the original Colorado AI Act, it needs a full refresh.
Georgia — SB 540: Chatbot Disclosure Act (SIGNED INTO LAW)
Signed by Governor Brian Kemp | Week of May 12–19, 2026
[Impact Rating: Medium]
Governor Brian Kemp signed SB 540 into law, making Georgia the latest state to enact chatbot disclosure legislation. The law requires operators of AI-powered chatbots to disclose to users that they are interacting with an automated system, not a human. It targets deceptive chatbot deployments in consumer-facing applications. More than a dozen states have now enacted or are advancing similar chatbot transparency statutes, and the absence of federal uniformity means compliance requires a 50-state monitoring posture. If you deploy customer-service, companion, or consumer-facing chatbot products, Georgia’s law adds to an increasingly dense state-level disclosure patchwork.
Illinois — SB 315: AI Developer Transparency (INTRODUCED)
Sponsor: Sen. Mary Edly-Allen (D-Libertyville) | Introduced: May 13, 2026
[Impact Rating: Monitor]
SB 315 requires large AI developers defined as those with gross annual revenues exceeding $500 million to create, follow, and publicly publish a framework detailing how the company incorporates industry standards, assesses model capabilities and catastrophic risk potential, and identifies and responds to safety incidents. The bill is part of a deliberate Illinois strategy to create a ‘de facto national standard’ by mirroring California and New York legislation. All but two of the eight-bill package’s bills passed out of committee unanimously. With less than a month left in the Illinois spring session, the path to enactment is tight but the unanimous committee vote suggests the political will exists.
Illinois — SB 416: AI in Education (INTRODUCED)
Sponsor: Sen. Robert Martwick (D-Chicago) | Introduced: May 13, 2026
[Impact Rating: Monitor]
SB 416 prohibits teachers from using AI to assign student grades and requires school boards to approve any AI use involving students or student work by the 2026-27 school year. The bill targets the growing use of AI tools in educational assessment — a high-stakes context that raises genuine concerns about bias, accuracy, and student rights. For EdTech companies and AI tool vendors selling into K-12 school districts, Illinois SB 416 represents an emerging category of sector-specific AI restrictions that could proliferate rapidly if the bill advances. Schools would need board-level approval for existing AI deployments, creating a new institutional gate for EdTech procurement.
New Jersey — S4279: Automated Decision System Disparate Impact (INTRODUCED)
Sponsor: New Jersey Senate | Introduced: Week of May 12–19, 2026
[Impact Rating: Monitor]
S4279 prohibits covered entities and their vendors from using automated decision systems in a manner that results in a disparate impact on a protected class. By targeting disparate impact not just intentional discrimination, the bill would require affirmative testing and validation of AI systems before deployment in consequential contexts including housing, employment, credit, and education. This goes further than most state AI bills to date. New Jersey’s existing anti-discrimination posture (the Division on Civil Rights issued algorithmic discrimination guidance in December 2025) gives this bill a meaningful enforcement infrastructure to land on. Companies deploying AI in high-stakes decision contexts in New Jersey should begin disparate impact testing now, the regulatory trajectory is clear regardless of this specific bill’s fate.
North Carolina — HB 963: Chatbot Disclosure (INTRODUCED)
Sponsor: North Carolina House | Introduced: Week of May 12–19, 2026
[Impact Rating: Low]
North Carolina introduced HB 963, requiring consumer-facing AI chatbots to disclose that users are interacting with an automated system. The bill mirrors recently enacted chatbot laws in Georgia and Colorado and is part of the continuing 50-state wave of chatbot transparency legislation. If enacted, it applies to any online service offering automated conversational interfaces to North Carolina consumers, regardless of operator location. North Carolina’s large financial services, healthcare, and technology sectors make this a relevant watch item even in early stages.
Also notable this week:
California advanced 17 AI and privacy bills out of Appropriations committees on May 15, including five chatbot bills, two employment AI bills, four health AI bills, and an amendment to the California AI Transparency Act (SB 1000). May 29 is the deadline for California bills to pass their chamber of origin. New York’s Senate passed two AI-adjacent pricing bills (S 8616, S 8483), and the automated lending decision bill (S 8115/A 773) advanced from committee. Colorado also passed HB 1263 (chatbot disclosure), HB 1139 (AI in Health Care), and HB 1195 (Psychotherapy AI Restrictions) before adjourning on May 14.
EU — AI Act Omnibus Agreement + Article 50 Transparency Consultation
[Impact Rating: High]
On May 7, the EU Council and European Parliament reached a provisional political agreement on the AI Act Omnibus that targeted amendments designed to simplify compliance and extend key deadlines. Key changes include a delay to the August 2, 2026 deadline for standalone high-risk AI systems, a new prohibition on AI systems generating NCII and CSAM, and a postponement of watermarking obligations under Article 50(2) until December 2, 2026. Formal adoption is expected by July 2026. On May 8, the Commission opened a 40-page targeted consultation on draft guidelines for Article 50 transparency obligations covering AI systems that interact with humans or generate synthetic content is open through June 3. For U.S.-based AI companies with EU exposure, these extensions provide compliance runway but do not eliminate obligations. The Article 50 consultation is a direct opportunity to shape how transparency requirements will be interpreted before they have the force of enforcement.