Rules and risks

How the rules work

The EU AI Act. Duties for providers of general-purpose AI models have applied since August 2, 2025, and the Commission's enforcement powers, including fines of up to 3% of worldwide turnover or €15 million, since August 2, 2026; models already on the market have until August 2, 2027. Every provider owes technical documentation, a copyright policy that honours opt-outs and a public summary of its training data, and models presumed to carry systemic risk (trained with more than 10^25 operations) add evaluations, incident reporting and security. As of October 7, 2026 the Code of Practice, the accepted way to show compliance, had 22 signatories including Amazon, Anthropic, Google, IBM, Microsoft, Mistral and OpenAI; xAI signed only the safety and security chapter, Meta declined, and DeepSeek, Alibaba and Moonshot aren't on the list. On September 1, 2026 the Commission confirmed requests for information to more than 30 unnamed AI companies, and no fines have been issued. For a builder the trigger is narrow: more than a third of the original model's training compute spent on modifying it.

Export controls. The AI Diffusion Rule was rescinded on May 13, 2025, and in July 2026 the Commerce Department's under secretary told Congress there would be no replacement. Policy now works through licences. Since January 13, 2026 Nvidia's H200 and AMD's equivalent can go to China case by case, capped at half of US volume per chip, with a 25% fee collected as a tariff and Blackwell excluded. China then blocked H200 imports in mid-January and later let in about 10,000 units each to ByteDance and Tencent, as reported, and Nvidia's outlook assumes no China data center revenue. The UAE got licence-free access for approved entities from July 10, 2026. Builders feel export rules as capacity and prices, and directly only if they give restricted parties remote access.

US states. California's SB 53 has applied to frontier developers since January 1, 2026, with safety frameworks, incident reporting and penalties up to $1 million per violation; I found no enforcement yet. New York's RAISE Act follows in 2027, and no federal preemption had passed by October 9, 2026.

Copyright. The costs land on the labs. Anthropic's $1.5 billion Bartz settlement covered about 482,000 books at about $3,100 each and got final approval in July 2026; the underlying ruling held that training on lawfully bought books was fair use and pirated libraries weren't. On September 29, 2026 the Third Circuit held in Thomson Reuters v. Ross that training a non-generative legal AI on Westlaw's headnotes wasn't fair use. It was the first appellate ruling on AI training and left the generative question open. Meta won on fair use in Kadrey in 2025, and the New York Times' case against OpenAI and Microsoft reached summary judgment briefing in September 2026. In Europe a Munich court held in November 2025 that OpenAI's memorizing song lyrics infringed, and an English court held that model weights aren't infringing copies; both are on appeal. Settlements can force retirements downstream: Warner Music's settlement with Suno requires it to retire its current models.

Indemnities. Paid tiers come with IP indemnities, each with conditions. Google's list covers its own models on Vertex, and third-party models in its catalogue aren't listed. AWS gives an uncapped indemnity for its own Nova models and narrower cover for others. Microsoft requires its content filters to stay on. Anthropic's commercial terms carry an uncapped IP indemnity, and OpenAI offers Copyright Shield. Routing to an open-weight or third-party model can drop you outside the list.

Chinese open-weight models. They're cheap and good, and they carry jurisdiction risk. NIST's AI standards center found in September 2025 that agents built on DeepSeek R1 were about 12 times more likely to follow hijacking instructions than US models. Several states ban DeepSeek on state devices, Congress opened a probe in July 2026, and the administration was reported to be weighing procurement bans and sanctions. If that happens, a cost-driven routing choice becomes a compliance problem.

Availability and data. Bedrock promises 99.9% a month per region, with credits of 10%, 25% or 100% of that region's charges as future credit. Anthropic's standard tier is "best-effort", its Priority Tier only "targets" 99.5% and isn't sold to new buyers, and OpenAI's 99.9% SLA sits in an enterprise tier with a minimum commitment. OpenAI keeps abuse-monitoring logs for up to 30 days, Anthropic keeps nothing by default except for its top models, which require 30 days, and Bedrock doesn't store prompts. A court can override any of it: in May 2025 a preservation order in the New York Times case made OpenAI keep output logs.

Sovereignty. "Sovereign" can mean an EU-run region of a US company (the AWS European Sovereign Cloud, opened January 15, 2026), an EU-owned lab (Mistral) or public compute (the EU's AI gigafactories, with bids due November 12, 2026). These regions tend to launch with open-weight models: the AWS one's debut model family on Bedrock, in September 2026, was Google's Gemma 4.

What mistakes cost

Let's say the help-desk company runs its button on a mid-tier closed model and pays $4,500-13,500 a month, about $54,000-162,000 a year. My rough arithmetic for what goes wrong and who pays:

• A three-hour outage in a 720-hour month cuts uptime to 99.58% and loses about 4,200 requests. On a lab's standard tier the credit is zero; on Bedrock it's 10% of that region's charges, about $450-1,350, as a future credit. With a gateway failing over to another provider, most of the loss becomes about $20-60 of extra tokens and some quality variance.
• A silent quality drop like Anthropic's 2025 bugs: if 5% of requests give worse answers for three weeks, that's about 37,500 degraded summaries, which no SLA treats as downtime.
• A retirement with 60 days' notice costs 10-40 engineer-days of re-testing ($8,000-60,000 loaded), and up to 30% more tokens if the new tokenizer counts more, about $16,000-49,000 a year on this bill.
• A third-party copyright claim is the vendor's to defend if the output qualifies for the indemnity; anything else is capped at 12 months of fees.
• A ban on a Chinese open model for one customer segment would push that traffic back to a closed model at three to ten times the price, plus the re-testing.

The operational events cost far more, in expectation, than the legal ones. The record so far:

Several of these are old failures in shared dependencies: DNS, a package registry, a sub-processor. The new kind is the quality drop that no contract counts.