Thelonious ICYMI — Edition 13 — 2 July 2026
Thelonious ICYMI — Edition 13 — 2 July 2026
Welcome to the 13th edition of ICYMI — your weekly briefing on the developments shaping the AI legal and regulatory landscape, curated from Thelonious.
Here’s a snapshot of what’s inside this week:
- California’s Partnership with Anthropic — California has announced a partnership with Anthropic to expand the responsible use of generative AI across state government. Under the agreement, state agencies, cities and counties may access Anthropic’s assistant Claude at a 50% discounted price, together with free workforce training, technical assistance and workflow support. Procurement is the quietest form of regulation and the most decisive. A state that buys a model at scale acquires leverage no consultation process delivers: contractual terms, service commitments, and a working relationship with the vendor’s compliance function. Note the timing against the litigation running in parallel against the same developer. Government is not waiting for the courts to settle the training-data question before becoming a customer, and the procurement terms signed now will shape the standards long after the judgments land.
- Council Gives Final Approval to the AI Act Simplification Regulation — On 29 June the Council of the European Union gave its final approval to the regulation simplifying selected provisions of the AI Act, completing the legislative process ahead of publication in the Official Journal. This is the Digital Omnibus reaching the end of the road, and it is worth being precise about what has been approved. The AI Act itself was not reopened for approval; a separate instrument amending it was. The distinction matters because the amendments are principally about timing — which obligations bite, and when. For any organisation that built a compliance programme against the original schedule, the operative question this week is not whether the rules changed but which of your internal deadlines just moved, and in which direction.
- Anderson v. Microsoft — On 30 June, plaintiff Eric Anderson filed a shareholder derivative complaint against Microsoft Corporation and members of its leadership in the Western District of Washington. The 49-page complaint alleges breaches of fiduciary duty and violations of Section 14(a) of the Securities Exchange Act concerning the company’s AI strategy, Copilot adoption and related financial disclosures. Most AI litigation to date has arrived through the front door: copyright, consumer protection, product safety. This one arrives through the boardroom. A derivative claim is not brought against the company by an outsider — it is brought on the company’s behalf against the people running it, and it turns on what the board knew, said and disclosed about an AI programme. AI adoption claims have become disclosure claims. That moves the risk from the general counsel’s inbox to the audit committee’s agenda.
- AI Incident Reporting Act — The proposed Act would require AI developers to report dangerous capabilities, security breaches and safety incidents to the US Commerce Department within seven days of discovery, with Commerce then obliged to notify Congress within 48 hours in the most serious cases. The Bill has not been enacted, and its prospects are uncertain. The mechanism is the part worth studying regardless. Mandatory incident reporting on a fixed clock is the model financial services and data protection both converged on, and it does something no substantive prohibition achieves: it builds a regulator’s evidence base. Seven days is short enough that the obligation reaches into engineering practice rather than legal review. Whoever writes the definition of “incident” writes the rest of the regime.
- Another Three Nudification Services Go Dark — Australia’s eSafety Commissioner has taken enforcement action against three further AI nudification services, compelling their withdrawal from the Australian market. The action proceeds under the industry codes governing age-restricted material, which require services generating explicit content to implement age assurance measures. Compare this with the European approach in the same area, where prohibition arrives through primary legislation and lengthy amendment. Australia is achieving withdrawal from the market through codes and a regulator willing to use them, on a timescale measured in weeks. There is a lesson in that about where enforcement capacity actually sits, and it is not always with the jurisdiction that has written the most law.