"Fifty states, fifty rulebooks. Luckily, dinosaurs have long memories."
Regional Chief-Dino, US & Canada
AI news from verified outlets; the United States and Canada first: federal, state, provincial, the agencies and the courts.
Law stated as at 3 November 2026; English prevails.
Governor Josh Shapiro signed Senate Bill 806, the Artificial Intelligence Deceptive Advertising Act, on 22 October 2026 as Act 99 of 2026; it takes effect on 21 December. An advertiser that uses content significantly modified or generated by AI in a way that creates a false impression about the nature, origin or authenticity of what it sells must carry a clear and conspicuous disclosure that the ad contains such content, shown the first time and in the same medium. Evidently fictional content, parody, satire, commentary, criticism and text-only content are outside it. The attorney general or a district attorney can seek an injunction and a fine of up to $3,000; there is no private right of action. Binding state law from 21 December, as summarised by Kelley Drye on 28 October and City & State Pennsylvania on 23 October. Correction: our 28 October issue said the bill was awaiting the Governor; he had signed it six days earlier.
SB 806 on the General Assembly's site →The Department of Law published a regulatory analysis on 21 October and says it will consider written comments received by 26 October in drafting the final rules on automated decision-making technology and chatbot safety. No adopted rules had been posted as at 3 November. The statute's duties begin on 1 January 2027. Status, not news.
Both chambers of Congress return on 9 November. The recommendations due under Governor Newsom's Executive Order N-9-26 are due on 16 November. Under Executive Order 14434 the proposed legislative language for a federal definition of Super Intelligence is due to the President by 28 November; the order does not require it to be published. Events and executive deadlines, not law.
Headlines link to their original outlets; the one-line gists are Toto-Rex's own. Curated 3 November 2026; check the source for the latest.
AI summits, conferences and seminars from credible hosts; across the US, Canada and online.
If you leave the study corner for one thing this year, make it this. The IAPP Global Privacy Summit is the largest gathering of privacy and AI-governance professionals in the world, held in the city where American AI policy is actually written. Thousands of practitioners, regulators and general counsel fill the convention centre; and AI governance now runs through nearly every session. If you want to see how the fifty-state patchwork and the federal agencies fit together, this is the room where it gets explained.
Why this one, and why you can trust it: Toto-Rex took no fee, no ticket and no commission to name it; it is simply the most useful and most credible AI-and-privacy gathering on the American calendar, and the AIGP credential was born from the same body. Read on for the full radar below.
Official site & registrationDates, venues and prices change; check them out yourselves before you go. Anything free is marked.
Talks, interviews and podcasts; builders, regulators, researchers and critics, in their own words.
Opposition to AI is starting to unite America's political left and right. Physicist Max Tegmark, chair of the Future of Life Institute, makes the case against racing to replace human work; a clear snapshot of the public mood regulators are now answering to.
Watch on The Economist's channelThese are external shows Toto-Rex rates. Links go to each show's official page; specific episodes come and go, so browse for the guest you want.
Introducing Toto-Rex
A dinosaur lost his job to an algorithm, so he set out to understand it: the rules, the regulations, and just enough of the technology to follow them. Focused on the United States and Canada; the federal pivot, the fifty-state patchwork, the agencies and the courts, and Canada's privacy-led path; in plain English, from credible sources. Serious about the learning. Less serious about himself.
Watch the music video: AI Fired Me
The newsletter is coming soon.
Released on YouTube, 8 October 2026
The song Toto-Rex™ wrote about the day AI made him redundant. Under two minutes, lyrics on screen.
Pressing play loads the video from YouTube. YouTube’s own privacy and cookie rules then apply.
No technical background. No shortcuts. Just one word, one rule, and one small victory at a time, written down so you can walk the same path without the late nights and cold coffee.
This is that path, tidied up and shared. Welcome in.
Choose a folder to jump to its section; everything stays on the page.
The side rail and menus still reach everything; picking a link opens its folder for you.
Each item summarised by Toto-Rex, linked to its original source. US and Canada first: federal, state, provincial, the agencies and the courts.
How this works: every summary is Toto-Rex's own plain-English take, and each card links out to its original source so you can read it yourself. Nothing is reproduced here. Educational only, not legal advice: for your own situation, ask a suitably qualified professional.
Scope. This briefing covers AI compliance, regulation and policy for the United States and Canada: federal executive policy, the state patchwork, the sectoral agencies and the courts; and, for Canada, PIPEDA, Quebec's Law 25, the federal Directive on Automated Decision-Making and the Voluntary Code. The events radar (section 09, below) covers US, Canadian and online events from recognised hosts. It does not try to cover the EU, UK or Asia (see the sister editions), or sector rules that don't touch AI.
Sources. Credible, verifiable sources only: official texts (the Federal Register, NIST, state legislatures, court dockets), established US law firms, recognised legal press such as Bloomberg Law, and peer-reviewed academic journals. Every card links to its original source, whether official text, law-firm commentary or press report.
Depth & timeline. Summaries are short by design; what a thing is and why it matters, then off you go to the original. Current as of 4 November 2026. There is no comprehensive federal AI statute; Texas's TRAIGA and California's SB 53 took effect 1 January 2026, and Colorado's replacement transparency law lands 1 January 2027.
Limitations. Toto-Rex is a dinosaur, not your lawyer. Summaries are his interpretation, they simplify, and the law moves fast; a federal preemption fight could yet reshape the whole map. Check the live source before you act, and take advice for your own circumstances.
Real cases, real settlements, one fictional lake; and your rights at every turn.
Pick a level of the system. Each opens with one featured overview Toto-Rex's plain-English summary of how that level governs AI; then notes on the real cases, laws and rules beneath it: what actually happened, what the rules say, what a company should never do, and what you can do about it. Every piece states its scope and links its sources, and none of it is legal advice.
How to read these: the cases, fines and dates are real and each note links its sources so you can verify them yourself; please do. The lake, Nessie and Colin are entirely fictional, and clearly labelled as such. None of this is legal advice, and it does not create any professional relationship; for your own situation, consult your lawyers. Based on the sources as at 4 October 2026; the law moves quickly.
The library. These notes are the public face of Toto-Rex's AI Compliance Library; at version 6.1.1, 187 research documents (about 115,000 words): twelve deep jurisdiction packs (UK, EU, US, Singapore, Hong Kong, mainland China, India, Japan, South Korea, Brazil, Canada, Russia), an EU-27 implementation matrix, a US 50-state & D.C. index, a wider regional atlas, and the policy and evidence templates beneath them. Research cut-off: 13 July 2026.
How it is sourced. The library cites 431 official sources, each recorded with its date. It is not reissued every time this page changes: anything added after its cut-off carries its own last-updated date.
What it is not. The library's own label applies here too: general information and customisable templates: not legal advice or certification. English is the controlling edition; official legal texts and their authoritative language versions prevail.
Rights, duties, penalties, dated agenda, operational practice and cross-border reach.
The two expert dossiers most relevant to this edition, the United States and Canada, are available here in compact English form. The interactive globe, all sixteen jurisdictions, treaties, comparative models and industry tracker remain in the Global edition.
Fresh AI uses in the wild; and the rule that walks in behind each one.
This week's front page is about Pennsylvania's new label for AI-made ads; the quieter story is what the software has started to do: browse, book, pay, file. An agent that acts is a different animal from a chatbot that talks; and existing US law already has a view. There is no single, comprehensive federal AI statute, but existing law reaches agents: an agent's click counts as yours when it acts within the authority you gave it (E-SIGN, 15 U.S.C. §7001(h)); authority, attribution and contract terms decide the hard cases. The FTC treats a deceptive automated act as a deceptive act, and the states' consumer laws agree. Toto-Rex's working rule: give an agent the least access it needs, log every step it takes, and keep a human hand on anything that moves money or people. Autonomy transfers work. It never transfers responsibility.
T.R., from the study corner
How this note works: with each weekly issue Toto-Rex picks one focus from the front page (finance, health, agents, hiring) and writes its compliance angle in plain English. The focus rotates; the discipline doesn't. Educational only, never legal advice.
An automated action is not automatically attributable to every user. Responsibility depends on authority, attribution rules, contracts and applicable law. Set permissions, approval limits and logs; using an agent does not by itself remove legal duties.
Anthropic's research notesFDA regulates software functions that meet the device definition, subject to exclusions. Its final PCCP guidance offers an optional route for specified planned changes: an authorized PCCP can avoid a new submission for changes made consistently with that plan. A PCCP is not required for every AI device, and guidance recommendations are not themselves binding law.
FDA · AI-enabled devicesDriverless taxis now run commercially in Phoenix, San Francisco and a growing list of cities. The rule that follows: there is no single federal robotaxi statute. NHTSA sets vehicle-safety standards while each state writes its own testing and deployment rules, so the law changes at every state line. Federalism, at 35 mph.
NHTSA · automated vehiclesAgentic coding tools now draft whole features. The productivity is real, and so are the new risks: licence contamination, secrets pasted into prompts, unreviewed changes shipping to production. The rule that follows: keep human review in the merge path, and lean on the NIST framework and the CISA/NSA joint guidance for secure AI.
CISA · secure AI guidanceApplications change weekly; the desk keeps only what is verifiably deployed, linked to its official source. Educational only; not legal advice, and never a product endorsement.
Markets, funding and the rules that referee them; refreshed with each issue.
OpenAI has confidentially filed for a stock-market listing, days after Anthropic's own move; the world's best-funded AI labs now want public money for the next generation of models and datacentres. For everyone else the prize is rarer than returns: quarterly disclosure. A listed lab must put revenue, risks and governance in writing where regulators, rivals and dinosaurs can read them.
Read it on TechCrunchThe defining money story of American AI is concrete and silicon: hundreds of billions in datacenter and chip commitments from OpenAI, Oracle, Microsoft, Google, Amazon and Meta. Capital expenditure, not model launches, is what shows up on the balance sheets; and the jobs, the power demand and the grid fights follow the money.
Reuters · AIThe Treasury's AI-in-financial-services framework translates the voluntary NIST AI Risk Management Framework into 230 concrete control objectives; the closest thing to a compliance checklist for banks, insurers and fintechs deploying AI. If you run AI in a regulated firm, this is your rulebook's front door.
US TreasuryNo single AI statute for banks: US financial regulators supervise AI through the rules they already have; the CFPB on fair lending, the SEC on disclosure and robo-advice conflicts, and the banking agencies on model risk (the SR 11-7 guidance). Existing law, pointed squarely at new tools.
SEC · on AIThe CFPB's circular is blunt: if an AI model denies someone credit, the lender still owes specific, accurate reasons under the Equal Credit Opportunity Act. “The algorithm decided” is not one of the permitted reasons. Model inventories for US lenders begin here.
CFPB · circularsToto-Rex's standing reminder: this desk reports the money; it does not manage yours. Nothing here is investment, legal or tax advice: markets move faster than dinosaurs, so verify at the source and consult your own advisers.
Seven numbered stops, from an AI inventory to a running compliance calendar, then across the border into Canada; the fifty-state problem, made walkable. Each expands when you want the detail.
What this is: the path Toto-Rex actually walked to stand up an AI compliance programme in the United States, in order; based on the official sources linked in each step, as at 4 October 2026. There is no single, comprehensive federal AI statute to point at, so this is a programme, not a form. Educational only, not legal advice: for your own setup, consult your lawyers.
Toto-Rex's note: one spreadsheet, one row per tool. If it isn't on the sheet, it doesn't exist; and if it decides something about a person, it gets a gold star and a lot more attention.
Toto-Rex's note: it is a strange country where the most important rulebook is one nobody must follow. He follows it anyway; it is the closest thing to being presumptively fine.
Toto-Rex's note: he keeps a US map with the states he serves shaded in. It looks like a weather chart. Some weeks it behaves like one.
Toto-Rex's note: he keeps a one-page privacy notice that actually matches what the tools do. The gap between the notice and the reality is exactly where the trouble lives.
Toto-Rex's note: ask which agency already regulates you. That is the one that regulates your AI now. The tool is new; the cop on the beat is not.
Toto-Rex's note: he keeps the whole calendar on one page taped above the desk. Compliance is not a mood. It is a recurring appointment.
Canadian applicability depends on the organisation, activity and province. PIPEDA, provincial privacy laws and federal public-sector policies have different scopes. Quebec section 12.1 addresses decisions based exclusively on automated processing of personal information. Compliance with EU or US state rules does not automatically establish Canadian compliance.
Why this matters. There is no single, comprehensive federal AI statute, so the risk arrives from three directions at once: the FTC and the sector agencies applying existing law to AI claims and AI harms, the states writing binding duties for "consequential decisions", and the courts. Rite Aid was banned from using facial recognition for five years in 2023 after the FTC found it falsely flagged shoppers as thieves; iTutorGroup paid $365,000 in 2023 to settle the first EEOC case over hiring software that rejected older applicants; two advisers paid $400,000 in 2024 for "AI washing" claims the SEC said were false; Facebook paid $650m to settle Illinois biometric claims. Texas now reaches intentional discrimination by AI with civil penalties up to $200,000 per violation, Colorado's SB 26-189 replaces the old high-risk regime with narrower transparency duties for automated decisions from 1 January 2027, and California's privacy regulator sets three separate duties: cybersecurity audits for businesses over its thresholds, risk assessments for significant-risk processing and, from 1 January 2027, notice and opt-out or appeal rights for automated significant decisions. The six stops below are the programme that stands up to all of it.
Toto-Rex's note: if a feature decides something about a person, it gets a gold star on the spreadsheet and most of the attention below.
Toto-Rex's note: one assessment template, three appendices (California, Colorado, Quebec). Nobody wants three documents.
Toto-Rex's note: "we tested it" means nothing without the test set, the date and the result. Keep all three.
Toto-Rex's note: the regulator does not need an AI law to act on a false sentence. It needs the sentence.
Toto-Rex's note: fifty clocks, one spreadsheet. Fill it in on a quiet Tuesday, not during the incident.
Toto-Rex's note: Canada does not need a federal AI act to regulate your AI. It has a privacy commissioner and a province that means it.
Find legal help for an AI decision: which expert, where to check them (55 official routes, 35 places), and a first-meeting card →
Founder's AI compliance file: what to decide and what to keep at every stage, from idea to exit →
Build and run AI with safeguards: cloud, APIs, retrieval, training, red-team and A/B tests, launch →
| Who | Authority and date | Outcome | What it was about |
|---|---|---|---|
| Rite Aid | FTC, December 2023 | Five-year ban on facial recognition | Store surveillance AI falsely flagged shoppers, disproportionately women and people of colour; no testing or oversight. |
| iTutorGroup | EEOC, September 2023 | $365,000 | The EEOC alleged its hiring software automatically rejected women aged 55 or older and men aged 60 or older; settlement announced on 11 September 2023. |
| Delphia and Global Predictions | SEC, March 2024 | $400,000 combined | False statements to investors about the use of AI ("AI washing"). |
| DoNotPay, Rytr and others | FTC, Operation AI Comply, September 2024 | Orders and refunds | "Robot lawyer" and AI review-writing claims that could not be substantiated. |
| Pieces Technologies | Texas Attorney General, September 2024 | Settlement with disclosure duties | Healthcare AI marketed with hallucination-rate claims the state found misleading. |
| Workado | FTC, 2025 | Order to stop claims | AI-content detector advertised as 98% accurate without adequate testing. |
| Facebook (Meta) | Illinois BIPA class action, 2021 | $650m settlement | Face-tagging biometrics collected without the consent BIPA requires. |
| Clearview AI | Privacy Commissioner of Canada and provincial counterparts, 2021 | Orders to stop and delete | Scraping faces of Canadians for a recognition database without consent. |
Figures as announced by each authority; appeals and later orders may change them. The pattern: unsupported claims, untested decisions about people, biometrics and children.
Sources. This note covers the compliance checklist above; the case study carries its own sources and date. Every date and duty in the checklist links to its official source: the Federal Register, NIST, state legislatures, the federal agencies and court dockets. Last updated 1 October 2026.
Scope. US AI compliance for a company operating across state lines. Not covered: company formation, tax, employment contracts, and anything bespoke to your situation. For the UK and EU, or Asia, see the sister editions.
Limitations. Toto-Rex is a dinosaur, not your lawyer. This is education, not advice; the law moves fast and the preemption fight could change the picture: always check the linked source, and consult your own professionals before acting.
Pick who you are; the duties and rights change with the seat you sit in.
You are the consumer the state laws were written for. Scope: your rights under state privacy and AI laws; they vary by state, and most cost nothing to use.
Not legal advice. Rights and deadlines vary by state; for anything that matters, consult a lawyer or a legal-aid service.
You deploy other people's AI on your own staff and customers; and the accountability is yours, not the vendor's. Scope: state privacy and AI laws where your users are, plus your sector's agency rules.
Not legal advice. A starting checklist, not a compliance programme; size it with your lawyers.
You make the thing; developer duties follow the product across state lines. Scope: state AI statutes, federal agency law, and the EU AI Act if your system or its output reaches the EU.
Not legal advice. Product classification and IP are exactly the questions to put to counsel early, in writing.
You process data or provide AI on other companies' instructions; cloud, SaaS, agencies, IT. Your customers push their duties down to you by contract. Scope: state privacy laws and your agreements.
Not legal advice. Your contract terms are lawyer territory by definition.
You operate across state lines; which means several rulebooks at once. Scope: every state where your users are.
Not legal advice. Multi-state mapping is genuinely fiddly; one workshop with counsel saves ten incident calls.
Your customers or data cross borders. Scope: US state law, the EU AI Act and the EU GDPR, all at once.
Not legal advice. Cross-border scoping is precisely where specialist advice earns its fee.
One more time, because it matters: everything on this desk is education, not legal advice: laws change, they differ by state, and your facts are yours alone. Consult your lawyers before you act. Toto-Rex will still be here when you get back.
Toto-Rex wants to try them all. Forgive him; he's a dinosaur, picking it up bone by bone.
Grouped by job. Listings link to each tool's official site; none of it is paid placement, and most have a free tier.
Where AI meets law, policy and product; straight from the boards that matter.
The federal government hires AI minds for model evaluations, standards and procurement. Security-cleared dinosaurs welcome.
The fastest-growing compliance title of the decade: AI inventories, impact assessments, NIST programmes and vendor triage. The IAPP's AIGP is the badge on the door.
The states are the front line, and their attorneys general are staffing up to write and enforce the new rules. Public-interest pay, front-row seat.
The Bay Area and beyond: alignment, interpretability, policy and trust & safety; not just engineering.
eDiscovery, AI governance practices, innovation counsel: the firms are staffing the workflows the book's Part IV describes.
As NIST and ISO/IEC 42001 harden into audit criteria, someone has to test the controls. ISACA's AAIA is the emerging credential.
Toto-Rex re-pins this board with each weekly issue from the official sources linked; postings, salaries and closing dates change daily, so always verify on the board itself. No placement fees, no affiliations; he just likes seeing dinosaurs employed.
Degrees, certificates and short programmes from universities, professional bodies and tech firms. None is run by Toto-Rex.
Toto-Rex is not paid to feature any of these, and there are no affiliate links on this site. Listings point to each provider's official page; details, prices and dates change, so check before you enrol. Anything free is marked.
Short films, songs about AI and honest tool tests; serious learning, carried lightly.
No technical degree here, and no rush; just one exam at a time. All the new AI can feel overwhelming, and a touch of FOMO is only natural, but once you know what you're aiming for, it's far easier to find your way through. Your pace, your path.
“Who says a T-rex can't reach their toes?” Toto-Rex, stretching
A monthly-ish letter; he aims for once a month, study schedule permitting, and would rather skip an issue than send you filler. Toto-Rex writes it himself, between study sessions and waiting on deliveries. The developments that matter, what the new rules mean, and one tool worth a look. Plain English, no jargon, no commitment.
Sign-up opens soon.
Cheers. See you next month. Probably.
Everything above is the serious stuff. This is the cherry on top: useless facts, small joys, and a dinosaur with opinions.
He told everyone the "T" in T-Rex stands for Technology. We both know it stands for Tyrannosaurus.
A 25 cm dome of solid bone on its head, evolved for headbutting rivals. And, Toto-Rex suspects, recruitment software.
Roughly how long his lineage survived. He still cannot get a CV past an automated screening filter.
A healthy attitude to a backlog, or a coping mechanism. Possibly both.
Of the Scottish Highlands. Also named Nessie, she runs a flourishing marketing company on the shores of Loch Ness; and is entirely out of his league, which, he notes, has never stopped anyone on a dating app.
Distant relations, technically. They hang about a certain museum looking down on everyone, and they haven't kept up with a single development since the Cretaceous. He visits anyway. Family is family.
The one thing on this site that is not negotiable.
A machine can draft, sort, total and summarise. It cannot care, keep a promise, own a mistake, or read a room. That part of the work was never in the job description. It was always you.
So learn the tools and mind the rules. Then bring what no model can produce: taste, judgement, kindness, and the nerve to ask the obvious question.
“Whatever the algorithm decides, you've got me, buddy.”
Toto-Rex
“The difference between AI and a person is that a person can feel pain. Then again, what would I know? I’m just a dino boy who eats fish.”
Step away from the syllabus. The dinosaur plays a patient game.
8–12 terms from the full glossary, refreshed daily. Ignore spaces and hyphens; letters only. Toto-Rex is watching. Supportively.
He reads more than he lets on.
He may or may not read this. He is usually studying, or waiting on a delivery. But he reads more than he lets on, and he appreciates you stopping by.
The postbox opens soon.
Everything this site teaches, bound, sourced and indexed.
AI has arrived faster than the law that governs it; and in America that gap is filled not by one statute but by four forces at once: the White House, the states, the agencies and the courts. The book strips away the maths, the hype and the fear: federal policy, the fifty-state patchwork, the NIST framework and the copyright fights, in plain English, built around a practical six-factor framework you can run on any AI system; five factors that follow its life, and a sixth you hold against them all. Written for founders, general counsel, educators, regulators and the professionally curious.
"A working machine asks: who answers for me?". Like everything in the study corner, the book is education, not legal advice. It sets out the law, cases, news and studies as at September 2026, reminds you to check them against the primary sources, and then tells you what the current situation is.
Toto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.
