AI security · for security leaders
The rules, the incidents, and what they ask of the CISO.
A sourced tracker of AI regulation and standards, a log of publicly reported AI security incidents, and plain answers to the questions security leaders put to AI search engines.
Coverage by year
Browse by year →regulatory milestone incident
Latest milestones
Full tracker →20268 entries
US StatesBill introducedNew York senator introduces RAISE Act 2.0 to let state pace frontier AI
US StatesSigned into lawNew York signs S.9051B, banning unsafe AI chatbot features for minors
US StatesSigned into lawNew York signs S.9508, requiring security safeguards on AI-enabled baby monitors
US StatesUS House Oversight Committee opens investigationUS House Oversight Committee investigates Delaware's AI-run company plan
US FederalFirst two volumes announced for fall 2026 releaseNIST sets fall 2026 release for first two SP 800-53 AI control overlay volumes
InternationalJoint guidance publishedCISA and Canada's Cyber Centre publish joint guidance on AI token consumption
US StatesSigned into lawPennsylvania signs the AI Deceptive Advertising Act, requiring disclosure labels
EUCouncil agrees negotiating positionEU Council agrees position loosening GDPR rules for AI training data
Explainers
All →
Q.What do California's SB 53 and New York's RAISE Act require of frontier AI developers, how do they differ, and what should a security leader at a developer or an enterprise customer do about them?What SB 53 and the RAISE Act require of frontier AI developers, where they differ, and what the signing documents say for security teams.
Q.What do CISA, NSA, ASD's ACSC and their partners recommend that security leaders do before and while adopting agentic AI services?What CISA, NSA, ASD's ACSC and partners tell organisations to do before and while adopting agentic AI, drawn from the May 1, 2026 guidance.
Q.What do the finalized CCPA regulations on cybersecurity audits, risk assessments and automated decisionmaking technology require of companies, and what should a security leader do before the deadlines?What California's finalized CCPA rules on cybersecurity audits, risk assessments and ADMT say about who must file what, and the dates to plan around.
Q.What do CISA, Canada's Cyber Centre and Australia's ASD ACSC advise security leaders to do about AI token consumption as an operational resilience and availability risk?Joint CISA, Canadian Cyber Centre and ASD ACSC guidance on AI token use as an availability risk: tiers, alerts, governance and fallback plans.
Q.Which enforcement actions have US state attorneys general and the FTC brought over AI, including healthcare AI, and which existing laws did they use?What Texas, Pennsylvania and the FTC did over AI claims and chatbots, and which existing laws each action relied on, per their own releases.
Q.How should a security team prepare for and respond to an incident where an AI agent acts outside its controls, according to the NIST, NSA and CISA guidance?What NIST, NSA and CISA say about preparing for and responding to incidents where an AI agent acts outside its controls, and what the documents leave out.