You have probably never read it closely — and if you have, you likely took it for a government seal of approval. So I went looking for the step where someone other than that company checks the sentence before the car is sold. There isn't one. The law makes the maker the certifier and says its certification "must be shown by a label or tag permanently fixed to the vehicle." In the words of the National Highway Traffic Safety Administration, "NHTSA does not pre-approve vehicles, through testing or other means, before they can be sold or otherwise introduced into interstate commerce." It checks afterward, typically by buying certified cars and testing them. In most other countries, Reuters notes, new models need regulatory clearance ahead of launch.

On September 3, 2026, Tesla began offering rides in Austin in its two-seat Cybercab, which Reuters called "a vehicle without a steering wheel or pedals." Tesla told NHTSA it had certified those Cybercab vehicles as compliant with all applicable federal safety standards. (The agency's own wording is more careful: the cars "lack permanently attached, conventional manual controls.") A car with no pedals, in other words, carries the same kind of promise as yours, from the same kind of author — and a week later, the first request in NHTSA's order to Tesla included "a representative photograph of the certification label."

Admire Tesla or not, the question is the one your own label raises — who checks the promise, and when?

Two files at NHTSA, and what each one asks

So what is NHTSA doing? Two separate things.

The first is an audit query, opened the day the rides began, that will weigh, among other things, "the extent to which Tesla's certification depended on determinations that certain FMVSS are inapplicable to the Cybercab" (FMVSS being the Federal Motor Vehicle Safety Standards your label refers to). On September 10 came a Special Order, a formal demand for information backed by penalties, with more than 20 requests to be answered under oath.

Among them: list any standard Tesla treats as inapplicable because it "did not when promulgated contemplate vehicles designed to perform the entire dynamic driving task" (rules written, in other words, for human drivers); say whether any touchscreen control lets an occupant move the car; and say whether temporarily attached controls were part of its basis for certifying. To be clear, those are questions. NHTSA has made no finding that the Cybercab breaks any standard.

One request goes straight at the missing pedal. The braking standard still reads: "The service brakes shall be activated by means of a foot control." In 2020, NHTSA said a car without a brake pedal couldn't be certified as meeting that line, and that until a rulemaking changes it, a maker "must seek an exemption." Another request asks Tesla to explain how its cars comply "without any exemption under 49 CFR Part 555."

As of October 24, 2026, the audit remains open, and the new due date for Tesla's response is October 30; Tesla had asked for eight more weeks and got 30 days. (Don't count on reading it all; the order lets Tesla ask for confidential treatment.)

The second file is about the driving. On September 23, a petitioner NHTSA doesn't name asked it to investigate Tesla's 2026 robotaxis, Model Y and Cybercab alike, alleging that with the automated system engaged they exceed posted speed limits in active school zones. The petition came with three video links; NHTSA counts four incidents and no crashes or injuries. On October 9, it opened a file "to evaluate the allegations and determine whether to grant or deny the petition." The law gives it not later than 120 days after the petition is filed, which lands around January 21, 2027. As of October 24, 2026, it hadn't decided.

A certificate for the car, but not for the driver

Now set the pedal aside. Suppose Tesla's certificate is flawless: what would it tell you about whether a robotaxi slows down near a school?

Very little — and NHTSA says so. The standards cover the machine (brakes, lights, mirrors, windshields, crash protection) and leave the driving to the person at the wheel. In its July decision to exempt Zoox's robotaxi, NHTSA wrote that "there are no performance requirements for an ADS that is replacing a human driver," ADS meaning automated driving system. Its proposal to drop the foot-pedal rule calls whether brakes are applied appropriately "an independent question relating to ADS performance." And its rulemaking to establish performance requirements for ADS only began on March 10, 2026.

By design, then, a school-zone allegation surfaces after the fact: as a petition, a crash report, an investigation, a recall.

Isn't this just a fight over pedals?

Fair question — and NHTSA half agrees. Its June proposal says manual driving controls are "not inherently necessary" in a car designed to be driven only by its automated system, and that an override a passenger could misuse "could pose a safety risk." It would drop the requirement for hand- or foot-operated brake controls in such cars, effective immediately if adopted; NHTSA does "not anticipate any safety disbenefits." As of October 24, 2026, that proposal and similar ones for other standards weren't final, and until they are, NHTSA said in September, "existing standards remain in force."

Nor is self-certification toothless. NHTSA's defect powers reach the software, even on fleets with conventional controls. In December 2025, Waymo, whose robotaxis have human controls but no human drivers, filed a software recall covering 3,067 vehicles that could pull away from a stopped school bus too soon. In January 2026, after a Waymo struck a child near a Santa Monica elementary school (minor injuries, Waymo reported), NHTSA opened an investigation into its school-zone behavior, "including but not limited to its adherence to posted speed limits." Tesla's own case is that the scrutiny is fierce. "If we injure even one person ... regulators will immediately clamp down on our activities," Elon Musk said on Tesla's July earnings call, as Automotive World reported.

Tesla isn't the first to try this, either. In 2022, Zoox certified its own purpose-built robotaxi, also designed without traditional controls, and NHTSA later opened an audit into whether that certificate rested on "determinations that certain standards were inapplicable," nearly the words it now uses about Tesla. Zoox's answer made the self-certifier's case: "not all FMVSS (or parts thereof) apply to all vehicle designs." By 2025, NHTSA was calling Zoox "an outlier in the industry, having self-certified these vehicles rather than seeking an available exemption." It cited "multiple apparent noncompliances" and closed the audit once Zoox applied for and received an exemption requiring it to "obscure or remove all existing statements" of full compliance.

This July, NHTSA granted Zoox a two-year commercial exemption, with conditions that include a label (or rider manual) listing the standards its robotaxi doesn't meet. NHTSA says exemptions let it "maintain enhanced oversight," but it drew no conclusion on whether Zoox's car otherwise complies, and this is the notice that says the software has no performance requirements. An exemption buys oversight — not a verdict on the driver.

Tesla chose the other road. As Axios describes it, Tesla argues the Cybercab already complies with vehicle safety rules and so "doesn't need a special exemption, which would require a limited production run." The law caps such exemptions at not more than 2,500 vehicles a year, for two years at most; a car its maker certifies as compliant faces no such ceiling. Tesla's engineering chief, Lars Moravy, has said of NHTSA: "I don't want to say we're in lockstep ... but I feel like we have a partner there, and we're working together on it." (Tesla's other robotaxi, the Model Y, "has the manual controls required by federal safety standards," Reuters notes.)

Britain asks first (and hasn't said yes yet)

Britain makes a driverless car ask first. Under its Automated Vehicles Act 2024, a car counts as self-driving only if it can drive itself "safely and legally," and "legally" means with "an acceptably low risk of committing a traffic infraction." Set that beside the school-zone petition: Britain's test asks, before a car is authorized, the question a petitioner had to bring to NHTSA after the cars were already carrying riders.

The rest follows. No car can be authorized until Parliament approves a statement of safety principles aimed at safety "equivalent to, or higher than, that of careful and competent human drivers." The draft principles open with complying with road traffic laws, speed limits, signage and road markings. An authorization takes effect only once it's entered in a public register naming the company responsible (Britain's version of your door-jamb label, written by the government), and that company can be fined when its car "committed a traffic infraction while the entity was responsible for it."

The catch: none of that is in force yet. Subject to the consultation's outcome, the government said in June, the safety statement will be "laid before Parliament next year for approval," meaning 2027. As of October 24, 2026, no car has been authorized under the Act, because none yet can be.

What is switched on, since May 15, 2026, is a permit scheme for automated passenger services — self-driving taxi- and bus-style rides. A taxi-style permit can't be granted "without the consent of each licensing authority" where it will run (Transport for London, in the capital), though consent is deemed given if, within six weeks of the government's written request, the authority hasn't answered or has refused without written reasons. A permit can be suspended or withdrawn if a vehicle "commits a traffic infraction that the Secretary of State considers is serious or repeated." The government says services must "meet stringent safety standards before they are permitted to operate."

And so far? Transport for London's understanding, in late August, was that "no operator has completed the first stage of the process." Uber and Wayve began paid rides in London on September 3 "with a licensed driver in every car," under ordinary private-hire rules, and Waymo says it is "ready to work with London to earn its consent." As of October 24, 2026, no permit had been reported granted.

So is Britain the model? Not cleanly. Its own consultation expects a higher safety bar to "delay the deployment of AVs on GB roads," and the safety benefits with them. Some respondents felt its "careful and competent" standard was "too low." And the civil sanctions for permit breaches aren't in force.

Picture the label in 2028

None of this has happened; it's my extrapolation from the documents above.

Start with the photograph NHTSA asked for. The rule puts the label "next to the driver's seating position," with fallbacks down to a spot the maker proposes and NHTSA approves. In a car built to have no driver, which seat is the driver's? (Where Tesla put its label hasn't been made public.)

Now suppose the brake proposal is finalized. The pedal question vanishes for new cars, and the certificate gets easier to stand behind while saying what it says today about school zones: nothing.

Then scale. Musk has said, Reuters reports, that the Cybercab will eventually be Tesla's largest-volume vehicle, with owners able to add their cars to a Tesla-managed ride-hailing fleet. On October 21, Lars Moravy said Tesla is "trying to get Cybercabs to customers by the end of this year," though Musk said the car will mainly be Tesla-owned. Picture a street of driveways — each holding a two-seater whose federal credential is its maker's label, each able to join a fleet while its owner sleeps.

Now send the petition's three videos to London. Under Britain's permit rules, a permit can also be suspended when several vehicles "commit the same, or similar, traffic infractions," so the clips would land with someone who could act on them directly, rather than in a docket that may decline to investigate. (A minister would be free not to act, though, and there's no permit to act on yet.)

Every piece of that picture already exists on paper, except a standard for the driving.

Who's worried, and who wants the rules rewritten

What do the people who study this say? Less separates them than you might think.

The critics are blunt. "I don't think there is a reasonable interpretation that can be made to suggest that the Cybercab can comply with the Federal Motor Vehicle Safety Standards," Michael Brooks of the Center for Auto Safety, a consumer advocacy group, told Reuters. Philip Koopman, a Carnegie Mellon engineering professor: "I fully expect Tesla to test the limits." Bryant Walker Smith, a University of South Carolina law professor, said no public information about Tesla's capabilities suggests it is "anywhere close to being able to safely and reliably deploy an automated driving system" across the wide range of conditions a car without conventional controls would need to handle.

Tesla has said its Full Self-Driving software is up to 10 times safer than human drivers, a company figure Reuters reported. The modernizers want the rules rewritten rather than skipped: the Reason Foundation's Marc Scribner warned in 2020 that unchanged rules "may significantly delay the wide deployment of what are expected to be far safer automated vehicles," and Chamber of Progress, a tech industry association, argued in 2025 for an exemption process with "the vehicle cap lifted to promote innovation." NHTSA's administrator, Jonathan Morrison, stands between them: "NHTSA fully supports the safe development and deployment of automated vehicles. But as the federal regulator, we need to ensure that all of our laws are followed."

And on one point a safety advocate and the regulator agree. "There are no federal safety standards that apply to the software in these cars that are driving themselves, and that's a real concern," said Peter Kurdock of Advocates for Highway and Auto Safety. NHTSA's Zoox decision says the same, without the alarm. They differ on timing — a gap to close before more of these cars arrive, or a rule to write while they keep arriving. (In July, HAIA summed up Consumer Reports' ask as wanting "the homework marked by someone other than the student.")

What does this mean for you?

• Read your own label for what it is. It names who built your car and promises conformity with the standards for your type of vehicle. The promise is the maker's; NHTSA checks after the fact.

• Know what it leaves out. No federal performance standard covers the software that drives a robotaxi yet; NHTSA started writing one in March.

• If a robotaxi breaks a traffic law in front of you, put it on the record. Federal rules say any interested person may file a petition asking NHTSA to open a defect proceeding. Write it in English, head it with the word "Petition," set out the facts and include your name and address. NHTSA has 120 days to grant or deny it.

• In Texas, tell the state too. Since May 28, 2026, companies running automated vehicles commercially need an active TxDMV authorization, and you can look a company up and submit public safety complaints through TxDMV's Automated Motor Vehicle Lookup page. (That authorization, too, leans on the company's written statement acknowledging that each automated motor vehicle meets certain requirements.)

• Weigh in. NHTSA's docket NHTSA-2026-1618, for its December 1–2 research meeting and automated-driving workshop, will remain open for comments until March 2, 2027; register for the meeting by November 24. NHTSA is also updating its voluntary guidance for automated driving systems, chapter by chapter, and docket NHTSA-2026-1520 takes comments until July 31, 2027. NHTSA's newest proposal, published October 26, would stop requiring turn signals that are self-canceling by steering wheel rotation in cars without manual controls (one of the questions its order put to Tesla); docket NHTSA-2026-1519 takes comments until November 25.

• In an exempt robotaxi, look for the exemption. Its label, or for Zoox possibly its rider manual, has to list the standards it doesn't meet.

• Mark two dates. October 30, 2026, when Tesla's sworn answers are due (they may not all be public), and about January 21, 2027, when the law expects NHTSA's decision on the school-zone petition.

The lesson, as I see it

The label on your door has always been the maker's promise, backed by a legal duty of care and checked, when it's checked, after the car is on sale. That worked because the standards described the car and a person did the driving. A car built to have no driver breaks that split. Its certificate can speak for its brakes and its glass, but not for the judgment that decides when to brake.

What Tesla tells NHTSA under oath, what NHTSA does with the petition, and whether its software standard arrives before these cars multiply will show where this goes. Britain, meanwhile, has to show that asking first can mean more than not yet.

My vote? Keep the maker's label — it's honest about who is making the promise. But before any car without driving controls (Tesla's, Zoox's or anyone's) carries paying passengers past a school, someone other than its maker should have checked how it drives, and the result should be as easy to find as the label on your door.

Every new car vouches for itself. A few of them now drive themselves, too.

If you did that for your taxes, you found 61 rows for the Internal Revenue Service. Three carry the label "high-impact," the federal tag for AI whose output serves as a principal basis for decisions or actions with a legal, material, binding or significant effect on people's rights or safety. Two of those three haven't been deployed, and the third is retired. None of them is in use.

I owe you an admission about that homework: it could only ever turn up what the IRS reported. On September 24, the Treasury Inspector General for Tax Administration (TIGTA, the IRS's watchdog) issued a report on five AI use cases used for workload selection — tools that help decide which returns and cases the IRS works. All five were deployed, and the IRS itself presumed them high-impact. Two of the five, TIGTA found, "did not have an impact assessment documented."

The September piece's caveat holds here too: "Nothing here proves anybody broke a rule." The IRS may well be allowed to keep systems like these off the public list (more on that below). But the list built to tell you what AI the government runs on you shows no high-impact AI in use at the IRS — while the IRS's own watchdog reviewed five.

Sixty-one rows and a watchdog's report

What's on the list? Treasury's own copy of the list carries the same 61 IRS rows as the consolidated federal file. Each of the three high-impact rows, among them a retired "Resume Scanner," carries a justification that says the opposite, a data-entry muddle that proves nothing either way. One deployed row, marked "Not High-impact," is a compliance model that predicts which small tax-exempt organizations filing Form 990-N, the e-Postcard, aren't eligible to file it. No row describes choosing income tax returns for audit. Could one of TIGTA's five be listed anyway, as "Not High-impact"? Nothing public says: the report doesn't name them, and the IRS's rows were first due in December 2025, before its manual added the audit presumption; no label changed for April's compliance deadline.

Now the watchdog. TIGTA says the IRS's own inventory held 225 AI use cases as of December 2025. It identified seven deployed high-impact uses drawing on data from the IRS's data warehouse and reviewed the five used for workload selection. What did it find?

• Missing assessments. Two of the five had no documented impact assessment, and the three that did "were conducted prior to the effective date of OMB Memorandum M-25-21 and based on prior guidance."

• Thin data paperwork. Four "did not have any testing documentation" for checks on their data, though IRS staff said "data quality checks were completed, and the data were fit for use."

• No instructions, by one account. The IRS's analytics office told TIGTA that as of July 2026 it had received no guidance or instructions from Treasury on the minimum risk practices. Treasury's 2025 compliance plan, for its part, says high-impact uses "are documented with risk management and mitigation plans."

To be clear, TIGTA checked paperwork, not performance; it "did not evaluate the accuracy of the data itself." The IRS agreed with both recommendations, says it has put standard data-quality processes in place, and says it will complete impact assessments for "currently deployed high-impact AI use cases as of November 2026." As of October 24, 2026, the inspectors general's shared site lists both recommendations as open.

Why does a missing assessment matter? M-25-21, the White House budget office's memo on federal AI, says that when a high-impact use isn't compliant with its minimum practices, the agency "must safely discontinue use of the AI functionality." Those practices include an impact assessment "before deploying any high-impact AI use case," and agencies had a year, until April 3, 2026, to document them. Does that mean the five should be switched off? TIGTA didn't say so, and I won't either.

More importantly, the IRS has a rule of its own. Its AI manual, in a section dated February 10, 2026, presumes high-impact any "AI that informs or influences whether a taxpayer will be subject to audit, or what aspects of a return will be subject to audit." That presumption is the IRS's own addition — the White House memo's list has no entry for tax audits.

Why presume it? Because how a selection system is aimed has consequences. A 2025 study in the Quarterly Journal of Economics, by eight researchers including Daniel E. Ho and Jacob Goldin, found that although audit selection was race-blind, Black taxpayers were audited at 2.9 to 4.7 times the rate of non-Black taxpayers, and it traced the disparity among earned-income-credit claimants largely to a policy decision to prioritize catching overclaimed refundable credits over other kinds of noncompliance. None of that research concerns the five systems TIGTA reviewed, but it shows why audit-selection tools earn the label.

Isn't the IRS allowed to keep this off the list?

Mostly, yes — and the IRS's side deserves a fair hearing.

The list was never meant to be complete. The executive order that created it in December 2020 asked agencies to inventory uses that are "non-classified and non-sensitive." The law that wrote it into statute in 2022 makes the inventory public "to the extent practicable" and subject to protecting "sensitive law enforcement" information. And the tax code shields the "standards used or to be used for the selection of returns for examination," and the data behind them, if the Treasury secretary determines disclosure "will seriously impair" enforcement. (Publish the audit formula and you've published a guide to staying under it.)

The IRS uses that room. GAO, Congress's auditor, found that 65 of the IRS's 126 active AI uses in June 2025 were either "too sensitive for public reporting" or exempt research, and that the IRS "may mark use cases sensitive that contain details about mechanisms related to law enforcement or tax enforcement." Of the uses GAO counted as publishable, fewer than half (25) made Treasury's January 2026 inventory, and IRS officials said some were withheld "at the request of use case owners or by Treasury." (Three counts, three scopes: 225, 126 and 61 measure different things at different dates, so don't subtract one from another.)

TIGTA reviewed the inventory, too, and "assessed non-reportable cases for accuracy"; it made no recommendation about either.

Then there's the person in the loop. In most cases, GAO found, the software "provides a risk score or recommendation for audit or investigation," and then "an IRS official reviews the output and decides whether to pursue the audit or investigation." (Two fraud-detection uses do act without human review; one pauses a refund on a possible identity-theft return, after which an employee reviews it.)

And the IRS argues that better software is good for honest filers. Its chief executive, Frank Bisignano, told the Senate Finance Committee in April that the agency uses AI and advanced analytics "to identify high-risk areas of non-compliance and fraud with greater accuracy," and that better modeling "will help us reduce the resources spent on false positives in audits." Fewer false positives means fewer honest people audited — a real benefit.

So the formula can stay secret. Can the fact that a system exists stay off the list, too? Here the rules pull in two directions. OMB's notes on the inventory let an agency leave out a use whose sharing would be inconsistent with the law, but where only particular details can't be shared, agencies "must only exclude those details, while including any fields that can be shared or released." The IRS manual tells teams to "mark the overall use case" withheld when a sensitive name or detail is needed to understand it. Whether these five were withheld under either instruction, or listed under another label, isn't public, and I'm not suggesting anyone broke either. But one leaves a row with blanks in it; the other leaves nothing to count.

Nor does a person in the loop settle the label: M-25-21 says a high-impact determination is possible "whether there is or is not human oversight for the decision or action." And the IRS isn't alone: on September 24, the Small Business Administration's inspector general found that SBA "has not implemented a process to identify high-impact uses."

France names the software and keeps the formula

What does it look like when a tax office keeps its formulas secret but tells you the software exists?

France's tax administration, the DGFiP, uses AI to target audits, and says so. Its Foncier innovant program reads public aerial images anyone can view for the outlines of buildings and swimming pools; an agent checks every anomaly before the owner is contacted or taxed. Its data mining produces lists of files that the Cour des comptes, France's public auditor, calls a decision-support tool, not a national audit schedule: only after human analysis might an audit follow. Same design as the IRS.

In April, the finance ministry published a yearly count of how many audits the software steered. In 2025, AI selection was behind 52 percent of the business files closed by regional and local tax offices (49 percent in 2024) and 54.6 percent of the individual files closed (up 9.7 points), and data mining put more than €2.8 billion in tax and penalties into collection. (That means assessed, not cash in hand.)

The law asks for more. French law has said since 2016 that a decision made with an algorithm must say so, with the rules and main characteristics given to the person on request, and larger administrations must publish online the rules of the main algorithms behind individual decisions. The DGFiP did that for tax calculation, publishing its income-tax, property-tax and housing-tax algorithms; since 2019, taxpayers have been told on their notices that an algorithm computes their tax.

But both duties yield to protected secrets, including the investigation and prevention of offenses. The government's own guide to the law names the DGFiP's fraud-targeting algorithm, CFVR, as a case where the targeting algorithm itself is exempt. France's Constitutional Council drew one line in 2018 — a secret algorithm cannot decide alone — but because people sort the audit lists, that limit doesn't reach them.

Before you crown France, the fair counterpoint. The numbers are the government's own, and they wobble: the minister's editorial in the same press kit puts the shares at more than 57 and more than 63 percent, figures that differ from the chart's. The Cour des comptes says the technology's effectiveness remains to be shown: data-mined audits were 44 percent of all audits in 2023 yet produced 13.8 percent of the tax and penalties put into collection, though 65 percent of the income-tax files the algorithm flagged did lead to an adjustment. And the famous pool hunt found 20,000 undeclared pools in a 2022 test, by the tax administration's count, but given that year's gains, the auditor called the DGFiP's original €130 million target unrealistic.

Others push from outside. In its advisory opinion on a 2020 experiment in collecting public online posts, the CNIL, France's privacy regulator, noted guarantees, among them no automatic audits. A 2024 parliamentary report by deputy Charlotte Leduc asked the DGFiP to periodically prove the tools carry no bias, since past audits are used to target future ones. And France's 2027 budget bill, pending as of October 24, 2026, would make the scraping permanent, with no facial recognition but no right to object.

France keeps its targeting formula secret, as the IRS does. But it tells taxpayers the software exists, names it, and publishes how much auditing it steers and what that auditing assessed — while its auditor and legislators argue over whether the numbers hold up. The secret and the scorecard coexist.

What November could bring

What follows is my extrapolation from the documents, not a forecast.

November comes, and the IRS finishes impact assessments for its currently deployed high-impact AI, as promised. If those uses stay withheld, or listed under another label, the inventory never shows it; the only public receipt may be a recommendation marked closed on an oversight website. The next inventory could look exactly like this one.

Or take the reclassification route. At the April deadline, FedScoop reported, the Energy Department's two deployed high-impact uses "went from high-impact to not high-impact, thereby exempting them from risk management requirements." Imagine an audit-selection model reclassified because a person makes the final call, though the memo says human oversight doesn't rule the label out. Would you ever see the paperwork?

Then Congress. H.R. 9501, the AI Tax Integrity Act of 2026, from Reps. Vern Buchanan and Steven Horsford, would have Treasury pilot AI to identify inaccurate returns and have GAO report on "the accuracy of the artificial intelligence tools" in that pilot. As of October 24, 2026, it sits on the House Union Calendar with no floor vote. If it passes, the first public accuracy figure for IRS AI could come from a pilot, while the list still shows no high-impact AI in use.

Meanwhile, the IRS's AI governance team told GAO it lost "over three-quarters of its staff" in 2025. More models, governed by fewer people, visible nowhere you can look: that future wouldn't require anyone to break a rule.

Both parties want more of it. Who's asking how it's checked?

Who's right? Start with this: almost everyone wants more of it.

Buchanan, a Florida Republican, says "we should be empowering the IRS to use modern, emerging technologies," and his bill is co-led by Horsford, a Nevada Democrat. Former Commissioner Danny Werfel told CNN that "AI gives us a forensic edge to select the right returns for audit," but that it must be balanced with "a human review – double checking and confirming AI is generating reliable output."

The caution comes from both flanks. Pete Sepp, president of the center-right National Taxpayers Union, told a Ways and Means subcommittee in February 2025 that "we must offer some caution over how AI could work to the detriment of taxpayers," citing an expert's view that an IRS automated tax assistant "has fallen short with certain responses." (His group still urged a yes vote on H.R. 9501 in September.) Ten senators led by Ron Wyden (nine Democrats and Maine independent Angus King) asked the IRS in January what protections ensure that "AI-driven enforcement decisions are auditable, explainable, and free from bias, including racial bias." And Barry Johnson, the IRS's former chief data and analytics officer, told CNN that AI "will make the IRS more efficient in finding noncompliance," but added: "I don't think AI is going to substitute for the staff who have been lost."

Not one of them asks the IRS to publish its formulas. The argument is over whether you can know the systems exist and are being governed — exactly what the public inventory was built to tell you.

What does this mean for you?

• Look up the IRS's rows yourself. Treasury's AI page links its inventory: 61 IRS rows, three marked high-impact, none in use. Read it knowing what the rules let it leave out.

• Keep the odds in proportion. CNN reports that "less than 1% of filers have been audited by the IRS in recent tax years."

• A real audit starts with a letter. The IRS says, "We won't initiate an audit by telephone." Treat a phone "audit" as a scam.

• Ask why, not how. You have a right to know "why the IRS is asking for information, how the IRS will use it" and what happens if you don't provide it. You won't get the formula (the law shields it), and the IRS's audit page credits "computer screening" without ever mentioning AI.

• Object, then appeal. The Taxpayer Bill of Rights gives you the right to "raise objections and provide additional documentation" and to "a fair and impartial administrative appeal of most IRS decisions." For high-impact AI, M-25-21 adds "a timely human review and a chance to appeal any negative impacts, when appropriate."

• Get free help. The Taxpayer Advocate Service is "an independent organization within the IRS," its service is free, and it answers at 877-777-4778 (eligibility rules apply).

• Watch November, when the IRS says its assessments will be done, and whether TIGTA's two recommendations close.

• If you want a say, ask your representative whether H.R. 9501, or any bill expanding AI at the IRS, should also require saying such systems exist. It's a bipartisan bill, so make it a bipartisan question.

The lesson, as I see it

The September piece put its faith in counting: the durable protection, it said, is "that the file is public, machine-readable, and counted by strangers." The IRS is a humbling test of that line. Strangers can count only what's on the list, and an agency can lawfully decide that what matters most stays off it.

So treat the inventory as a floor. The tax code shields selection standards and the data behind them, and the sentence that does so says nothing about listing that a system exists. OMB's own notes already point to the middle path: exclude the sensitive details, keep the row.

My vote? Give every deployed high-impact system a row, even a mostly blank one: a generic description, whether it's presumed high-impact, whether its impact assessment is done and, once a year, the share of audits it touched and what they assessed. France publishes a version of that last part while keeping its formula secret. The IRS could too, without revealing a single selection criterion. Until then, watch November, watch the next inventory, and keep counting what you're allowed to count.

Share this with whoever does your household's taxes (if that's you, consider it shared), so when the next IRS envelope lands, they know which questions are theirs to ask.

Did an AI company's crawler pass through it? Did a model learn from it? Europe wrote a rule that was supposed to give people like you a place to start looking — and the instruction at its center fits in one sentence.

It sits in Section 2.3 of the European Commission's template for the public summaries AI companies must publish about their training data, and the Commission's FAQ leaves no room for doubt: "using the Template is mandatory." The sentence tells each company to "provide a list of those most relevant internet domains names (top and second-level domain, e.g. “example.com”) by listing the top 10 % of all domain names determined by the size of the content scraped." The form even suggests a format: "You can provide this list for instance as a downloadable file or provide here information on how to access it."

Who was it for? The Commission's explanatory notice says this kind of transparency "should help rightsholders obtain relevant information on the content used in the training of general-purpose AI models." If the words you posted are your own, that sentence is about you.

So I read what six of the biggest AI developers put in that box: OpenAI, Google, Anthropic, Meta, Microsoft and xAI. (A disclosure: this piece was drafted with help from Anthropic's Claude.) Of the 48 documents I read from those six, 36 have the box (Microsoft's older cards use a layout without it). In 33, it describes kinds of sites or points somewhere else: "community and general-interest sites," "public reference platforms," "math sites" and, from Meta, a pointer to a page about its crawlers. Microsoft's lists "blogging and personal-publishing platforms" among its top 10 percent, without naming one. In the other three, all filed by xAI in August and September, the box names one site, "X social media platform," as the newest puts it. The company behind those summaries owns the social network X.

That is the whole tally as of October 13, 2026. Europe asked for the biggest tenth of the domains each company scraped, with "example.com" as the model answer. Between them, six of the largest companies in the business have put one site in that box — and it belongs to the company that filed it.

None of this tells you whether your work was used. The summaries don't say that about any site, in either direction.

A law that leaves the detail to a form

Start with the law. Article 53 of the EU's AI Act requires every provider of a general-purpose AI model to "draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model, according to a template provided by the AI Office." (General-purpose models are the large ones underneath chatbots and image generators; the AI Office is the Commission's enforcer for these rules.) What counts as "sufficiently detailed," in other words, is settled by the form.

The Commission published the template in July 2025 as what it calls a common minimal baseline. The duty itself has applied since August 2, 2025, with the exception of Article 101 — the fines — which waited a year. (I noted this carve-out for the fining power over general-purpose AI models in August.) Since August 2, 2026, the Commission can impose fines not exceeding 3 percent of a company's worldwide annual turnover, or €15 million, whichever is higher. Each summary is supposed to be updated "at six-month intervals," or sooner after a materially significant change. And the Digital Omnibus on AI, which moved one of the law's deadlines in July, left Article 53 untouched.

Inside Section 2.3, the part of the form for data crawled and scraped from online sources, is the box this piece is about. Its instruction is the sentence above: the domains, at the level of "example.com," that make up the top 10 percent of everything scraped, measured by size. (Smaller companies may stop at the "top 5% of all domain names or 1 000 internet domain names, whichever is lower.") The notice's own footnote says Section 2.3 "requires a list of the internet domain names."

So far so good: a rule, a form and a sentence plain enough to follow. What did the six companies write?

Six companies, one box

Below is one recent summary from each company, as of October 13, 2026, and what it says in that box.

• OpenAI, GPT-6 Astra (dated September 2, 2026): "The most relevant crawled source domains include academic, research, patent, and other technical repositories, legal and government resources, document-hosting and sharing services, community and general-interest sites, and region-specific portals." OpenAI's other summaries repeat the same list, except the one for its Images 2.0 model, which lists other categories.

• Google, the Gemini 4 family (dated October 13, 2026): "The most relevant domains crawled include publicly available websites across educational, government, legal, and research sectors, such as open web sources and public reference platforms that are maintained for research and educational purposes." It adds "top-level domains such as .com, .org, and .edu." Google's summaries for Gemini 3 and Gemma 4 also describe websites across educational, government, legal, and research sectors.

• Anthropic, Claude Opus 5.5 (dated September 22, 2026): "Data used in model training which is derived from data crawled and scraped from online sources includes technical documentation, open-source software, predominantly text-based reference sites, document sharing sites, and math sites." It adds that "Top-level domains such as .com, .org, and .net are included alongside sites from a range of different countries." All ten of Anthropic's model summaries list the same categories.

• Meta, Muse Wonder (dated October 12, 2026): "See the developer center resource linked above for more information about Meta's web crawlers." The page it points to says the Meta-ExternalAgent crawler crawls the web for uses "such as training foundation AI models," and it lists Meta's crawlers and robots.txt rules. It lists no domains. Meta's reports for Muse Spark, Muse Image and Muse Glimmer give the same pointer.

• Microsoft, MAI-Thinking-1 (dated August 12, 2026): "The top 10% domains by volume crawled and used to train MAI-Thinking-1 span a broad mix of content types." It goes on to "publicly available reference and knowledge sites, blogging and personal-publishing platforms, social and professional networks," and eight more kinds, adds that "General web hosting, blogging, social, and e-commerce platforms make up a large share of the total," and lists country codes from .jp to .nz. Microsoft's other recent MAI cards use the same formula or, for image models, a similar list of categories.

• xAI, Grok 4.7 (dated September 21, 2026, and filed under the company's new name, SpaceXAI LLC): "Crawled sources include certain data from content hosting and content sharing services, like X social media platform, educational repositories, government and institutional resources, community and document-sharing sites, and region-specific portals." Its August summaries, for an update to Grok 4.5 and for Grok Imagine Image 2.0, name "the X social media platform" in the same place. Its July summaries named no site.

Read side by side, the six answers sound like one answer. Microsoft's is the most descriptive, and it names no site; neither do OpenAI's, Google's, Anthropic's or Meta's. xAI's names one — X.

To be fair to all six, these documents aren't empty. Elsewhere in them, most of the companies name names. OpenAI says GPT-6 Astra's training data "includes text from Common Crawl." Anthropic's lists datasets "notably including Common Crawl." Microsoft names "GitHub public repositories, Wikipedia, and CommonCrawl." Meta names "publicly shared posts from Instagram and Facebook." xAI names "Common Corpus (Pleias), OpenAlex metadata, and Crossref metadata." Google's describes Google-Extended, a control for web publishers. (I described Google-Extended in August as a product token publishers put in robots.txt.) Most also name their crawlers. So the companies can name things when the form asks. In the one box that would tell you whether your corner of the web was among their biggest sources, they wrote kinds of sites — and, in xAI's case, its own platform.

Others, reading other sets of summaries, found the same thing. ActuIA, a French AI news site, compared 24 summaries in September and found that "21 include this section and none name a site," although its sample included two OpenAI summaries and none from the other five companies here. On August 7, the AI Accountability Lab, a research group that tracks these summaries (its work has received Mozilla Foundation funding), wrote that "despite template explicitly asking for domains crawled, no provider has indicated which specific websites they crawl." Its list either predates or missed the three xAI summaries that name X.

Even a perfect list would leave you guessing

Would a fully filled-in box tell you whether your work was used? No. Why? Because the form limits what it can show, in four ways.

First, it leaves out the big shared collections. The domain list excludes "publicly available datasets already compiled by third parties and made available on platforms such as common crawl that are covered under Section 2.1." (Common Crawl publishes archives of crawled web pages; three of the six summaries quoted above name it.) Section 2.1 only requires naming "large" datasets, those above 3 percent of all the publicly available data used for a given kind of content, and even there, the AI Accountability Lab found, providers "rarely indicate which snapshots were used in the training of their model."

Second, it stops at the domain. The template asks for "top and second-level domain," so a blog hosted on a big platform would show up, at most, as the platform.

Third, it stops at the top tenth, by volume. Whether a small site makes the cut depends on how much else was scraped.

Fourth, the regulator won't go work by work. The notice says the AI Office may check whether the template was filled in correctly "without performing a work-by-work assessment or checks whether specific content has been used or not."

In short, a perfect box could tell you that your domain was among one company's largest sources. It couldn't tell you that your post was read, or which model learned from it. The box was only ever a starting point — and the starting point is what's missing.

Isn't a summary supposed to summarize?

It's a fair question, and the companies have a better answer than you might expect.

Start with the law's own preamble. Recital 107 of the AI Act, which the Commission's notice quotes, says the summary "should be generally comprehensive in its scope instead of technically detailed," so that parties with legitimate interests, "including copyright holders," can enforce their rights. (Recitals are the paragraphs at the top of an EU law that explain what its articles are for.)

Then the notice describes Section 2.3 in its own words: "the Template requires a disclosure of a summary of the list of top domain names crawled and scraped from online sources in a summarised narrative form." In the same paragraph, it says the template "does not require disclosure of the details for the specific data and works used to train the model." Four paragraphs on, it describes the box as striking "a balance with the trade secrets ensuring the Summary remains non-technical and in a summarised narrative form." A summary of a list, then, in narrative form. Read that way, "community and general-interest sites" is an answer.

The industry asked for exactly this before the template existed. In January 2025, CCIA, a tech-industry trade group, put out its own model template, arguing that "transparency measures may not compromise AI model safety, trade secrets, or confidential business information" and that "The information should be provided in narrative form," with sources described in categories such as "public web scraping of internet websites." The six answers in the box read a lot like what CCIA proposed (that comparison is mine, not CCIA's).

And the stakes, as xAI tells it, are real. In its California case, xAI argues that "If xAI revealed details about its datasets, competitors would immediately move to acquire the sources xAI uses that its competitors lack to ensure that their models match xAI's." That's an argument in a brief, but it puts the trade-secret worry plainly.

Has anyone with the power to decide ruled that these answers fall short? Not as of October 13, 2026. As ActuIA put it, "Whether these sections satisfy Article 53 is for the Commission to decide." Euractiv reported on August 7 that "The AI Office has flagged deficiencies in some training disclosures," without naming them in the part of the story outside its paywall. On August 26, Euractiv's Maximilian Henning reported the Commission's first use of its new enforcement powers and that, separately, its enforcers had asked "more than 30 AI companies to detail how they're complying with European copyright rules," and, citing Commissioner Henna Virkkunen, that the Commission had approached developers "that failed to publish the training data form or had not responded to informal inquiries about copyright compliance." The copyright requests, as reported, were about missing forms and unanswered questions. I found no reporting that ties them to forms filled in with categories.

So are the companies breaking the rule? I won't say so, and no one with the authority to decide has ruled that they are. My point is narrower. The narrative-form language and the list instruction sit in the same document. The notice that allows "a summarised narrative form" also says, in a footnote, that the box "requires a list of the internet domain names," and the form's own instruction says "provide a list," uses "example.com" as its example and offers "a downloadable file" as one way to deliver it. A summary of a list is a summary of something. The six published the summary. None of them published the list.

That's why I call these answers non-specific rather than unlawful. Whether non-specific is enough is the Commission's call, and as of October 13, 2026, it hasn't made it.

California asks a smaller question and gets the same answer

Is this a European problem, or a disclosure problem? California offers a test, because the same six companies face a looser version of the same question there.

California's training-data law, AB 2013, now Section 3111 of the state's Civil Code, requires a developer to post "documentation regarding the data used by the developer to train" a generative AI system, beginning with "(a) A high-level summary of the datasets." The first of its twelve items is "(1) The sources or owners of the datasets." The twelve never ask for a website, a domain or a URL. Europe asked for domains and got categories. California asks for sources. What did the same companies post?

• OpenAI's "Training Data Summary Pursuant to California Civil Code Section 3111" says: "We develop these systems using a variety of data sources, including publicly available data, data that we partner with third parties to access, and information that our users or human trainers and researchers provide or generate." It names no dataset, crawler or site; its EU summary names Common Crawl and GPTBot.

• Google posted one summary, dated June 1, 2026, for 23 of its products, from Ads to YouTube. Its sources include "publicly available datasets, licensed data obtained via commercial licensing agreements, data obtained by crawlers, data collected from our users and also user interactions with the models."

• Anthropic's "Training Data Documentation," dated December 2025, says "Claude models are trained on a proprietary mix of data from the following source categories" and lists five, including "Publicly Available Internet Data: Content from publicly accessible repositories as well as content crawled from the public web." It names no dataset, crawler or site; its EU summary names Common Crawl and ClaudeBot.

• Meta's page "AI at Meta: Transparency about our training data" answers, one by one, the twelve questions California's law asks, without naming the law. Its sources: "a mix of publicly available data, licensed data and information from Meta's products and services," including "publicly shared posts from Instagram and Facebook and people's interactions with AI at Meta features."

• Microsoft: I couldn't find a page labeled for California's law when I searched on October 13, 2026, which isn't the same as Microsoft not having posted one. Its general "Data for AI model development" page says: "We train on select publicly available data, from a mix of industry-standard machine learning datasets and web crawls."

xAI, the sixth, is the one that sued. I wrote in September about how it went to court to establish that the state can't make it post more than the page it put up the day after it sued, so I won't re-argue the First Amendment question here. Where things stand as of October 13, 2026: a federal judge denied the preliminary injunction on March 4, 2026; in the Ninth Circuit, the appeal is scheduled for oral argument on November 18, 2026, in Pasadena. (The court's notice adds that "the panel may decide to submit the case on the briefs instead.") There's no decision.

As for xAI's own California page, posted on December 30, 2025, the court's order quotes the company calling it a "high-level, limited disclosure" "that does not reveal its trade secrets." I couldn't find it among the documents on xAI's legal page on October 13, 2026, so I'll leave its contents at the company's own description. One line in xAI's reply brief echoes Europe, though: California, it says, "refuses to disavow enforcement against xAI or take a position—even at the district court's request—on whether xAI's disclosures suffice." That's how xAI describes the state's position.

Side by side, a few things stand out. Europe's stricter form drew out more names from some of these companies: OpenAI names Common Crawl and GPTBot in Europe and neither in California, and Anthropic names Common Crawl and ClaudeBot in Europe and neither in California, while Meta names Instagram and Facebook posts in both. But in the one box built for people with websites, Europe's answers look like California's: kinds of sources rather than sources. And as of October 13, 2026, neither regulator has ruled on whether that's enough — the AI Office hasn't, and California, by xAI's account, won't say.

Stanford researchers who compared the California documents from OpenAI, Google and Anthropic, in a paper posted in January, found that they varied in detail and concluded that "none of these disclosures are specific enough to guarantee protection of personal data and copyright, nor do they provide enough information for actionable change to training data practices."

Now picture the file attached

Everything in this section is my extrapolation, not a forecast about any company. It wouldn't take a new law, either; the hooks are already in the documents.

Picture it from your side first. A summary update arrives with a file attached in Section 2.3, the way the template suggests, and you search it for your domain. Maybe it's there. Maybe your platform is, with you somewhere inside it. Maybe there's nothing. Even an empty search would tell you something you can't learn now.

Picture the six-month diff. Summaries are supposed to be updated "at six-month intervals," and xAI's wording has already changed once, between July and August, when "the X social media platform" appeared in the box. Imagine publishers, researchers and reporters reading these documents the way programmers read software changelogs: lining up each version against the last and asking what appeared, what vanished and why. With updates twice a year, a category that quietly drops out becomes a story.

Picture the first request for the real list. The AI Act lets the Commission ask a provider for its documentation "or any additional information that is necessary for the purpose of assessing compliance," and ask providers to "take appropriate measures to comply with the obligations set out in Articles 53 and 54." Imagine the first such request asking not for a better paragraph but for the file the template already describes. (No such request has been reported as of October 13, 2026.)

Picture the template revised. The Commission says it "will monitor the implementation of the Template" and "where necessary review the Notice and the Template." Imagine a version in which the downloadable file is the default and the paragraph is the footnote. It could go the other way, too. The Commission's open copyright consultation asks people to rank options it says it hasn't endorsed. One would have companies share information under a nondisclosure agreement, on a rights holder's substantiated request, "as an alternative to the public disclosure of the top 10% of the top domain names."

Picture a lookup that joins the pieces. The public crawl archives and the summaries that name them are already out there (the list below points to both). Imagine one screen that tells a recipe blogger which crawls captured their site and which models' summaries name those crawls. Joining the pieces is the part no one has been required to do.

Picture Pasadena. Whenever the Ninth Circuit rules, the case can go two ways. In one, California's law survives — including its first item, "The sources or owners of the datasets" — and the next fight is over whether a category counts as a source. In the other, a ruling for xAI unsettles even that item.

Who saw this coming, and who thinks it's fine

The warnings came early. On July 30, 2025, six days after the template came out, Zuzanna Warso of Open Future, a European open-knowledge group, wrote that the template's language "could be interpreted as requiring only the top 10% overall—a single aggregated list that could completely obscure modality-specific sources." Where the form settles for "general descriptions" of data processing, she warned, "This opens the door to corporate boilerplate and essentially meaningless responses." Her advice: "if the first wave of disclosures proves superficial, the AI Office must be ready to correct course quickly."

The same day, a coalition of rights-holder groups (authors, performers, publishers, producers) rejected any claim that the template "will deliver “sufficient” transparency about the majority of copyright works." Its verdict: "This is simply untrue and is a betrayal of the EU AI Act's objectives."

A year on, the people reading the first summaries found the kind of answers those groups had warned about. ActuIA's version: "A category such as general knowledge resources does not allow them to find their own domain, nor to conclude that it was used or that the collection was unlawful." The AI Accountability Lab's, from an August 31 post on public datasets: providers are "answering a question analogous to “where did you get this information?” with a generic “the internet”" (a line worth pinning above the whole exercise).

On the other side, the case for less detail rests on trade secrets, in CCIA's proposal and xAI's brief, both quoted above. The regulator, so far, has talked about process: not every developer of the "most advanced" models got its request for information, Virkkunen said, as Euractiv quoted her, "because, with some of them, we have already had very close dialogue during the last months."

California's law, meanwhile, has defenders you might not expect. The Knight First Amendment Institute, a free-speech group, told the Ninth Circuit that "These disclosures are undisputedly factual, noncontroversial, and related to xAI's commercial products." (xAI disputes exactly that.) Tyler Whitmer and Ben Rashkovich of LASST, an AI-safety legal advocacy group, called the law "the functional equivalent of an ingredient label" in a July op-ed. And the AI Coalition for Data Integrity, developers and creators who license data (its brief's co-signers include John Wiley & Sons and the National Association of Voice Actors), put the licensing market's view in two sentences: "The developers that suffer no injury from these disclosures are the ones that obtained their data lawfully. That is the point."

Line them up and the alliances are unusual. Rights holders and open-knowledge advocates warned of thin answers; accountability researchers found category answers. The industry asked for narrative form before the form existed. A free-speech institute is defending a disclosure mandate. (One gap, in fairness: I looked for a free-market think tank's view of Europe's domain box and didn't find one, so the case for less disclosure is made here, in their own words, by the industry's trade group and by xAI.)

What does this mean for you?

Nothing below will tell you whether a particular page of yours trained a particular model; the documents don't say that about any site. But there's plenty you can check.

• Read the box for the models you use. It's Section 2.3, on data crawled and scraped from online sources. OpenAI publishes summaries about the content used to train its models on one help page. Google posts its summaries as downloadable reports on its transparency report site. Anthropic keeps its training data summaries in its trust center. Meta's sit on its regulatory transparency reports page, and Microsoft's MAI data summaries on its own site. xAI lists its public summaries of training content on its legal page. Expect categories, not names.

• Search Common Crawl yourself. Its index server lets you search the CDX URL index for any of its archives by entering "a URL pattern." Two cautions. Common Crawl calls its dataset "a sample of the web" and says it does not generally archive any entire website, only "a randomly selected subset" of one, so not finding your page proves little. And finding it doesn't show that any model trained on that snapshot.

• Opt out going forward, crawler by crawler. These signals say what may be collected or trained on from here on.

  • OpenAI: "Disallowing GPTBot indicates a site's content should not be used in training generative AI foundation models."

  • Anthropic: blocking ClaudeBot (User-agent: ClaudeBot) signals that a site's "future materials should be excluded."

  • Google: Google-Extended is "a standalone product token" for Gemini training, and Google says it doesn't affect your site's place in Search.

  • Meta: Meta-ExternalAgent is the training crawler; to block it, "add a disallow for the relevant crawler to robots.txt."

  • Microsoft: the MAI-Thinking-1 summary names Bingbot, which, it says, indexes web content "for both search and model training." Bing said in 2023 that content labeled NOARCHIVE won't be used "for training Microsoft's generative AI foundation models" and "will still appear in our search results." (By that logic, blocking Bingbot outright would also take you out of Bing search.)

  • Common Crawl: two lines, User-agent: CCBot and Disallow: /, and "our crawler will stop crawling your website."

  • xAI: Grok 4.7's summary names a "SpaceXAI Web Crawler" and says SpaceXAI "respects instructions that identified crawled content should not be used to train" its models, but as of October 13, 2026, I found no robots.txt name for that crawler published by xAI.

• If you're in the EU and hold rights in your work, you can ask, and complain, within limits. The Commission recommends that providers "act in good faith and on a voluntary basis" and tell rights holders, "upon requests," whether they scraped and used content from "specific internet domains." It's a recommendation; nothing in the notice obliges a company to answer. Companies that signed Europe's code of practice committed to "designate a point of contact" for rights holders and to take complaints, though those complaints concern a signatory's "non-compliance ... with their commitments" under the code, not whether your site was used. As of the code page's October 7, 2026 update, Anthropic, Google, Microsoft and OpenAI are signatories; xAI signed up to the Safety and Security Chapter only; and Meta isn't listed.

• Tell the Commission what you want in that box, by November 3, 2026. Its targeted consultation on copyright and AI takes answers from individual authors as well as companies, and one option would replace the public list with private disclosure to rights holders. If you want the list public, say so there.

• If you're in California, the law asks for "the sources or owners of the datasets," and the pages above show what that has produced so far. Watch November 18, 2026, in Pasadena.

The lesson, as I see it

A form is a promise about what you'll get to see. Europe's promised a list, gave "example.com" as the model and suggested a downloadable file. From six of the biggest companies in the business, it got well-made paragraphs and one name — which belongs to the company that wrote it.

The law allows paragraphs, and I've tried to give the companies' reading its full weight. But a rule written to help people who publish online learn what went into these models shouldn't stop at a list of kinds. Categories describe the web. Names would describe what was scraped from it.

The good news is that the answers can change without a new law. Every summary is due for an update every six months. The Commission has been able to fine since August 2, 2026, and it can ask for more. Until November 3, it's also asking whether private disclosure to rights holders should replace the public list. xAI's challenge to California's law is set for argument in the Ninth Circuit on November 18. And models already on the market before the rules have until August 2, 2027 to comply, which means a second wave of summaries is coming, for the models people have used longest. It can arrive with lists attached, or the way this one did.

My vote? Ask for the file. The template already has a place for it.

Somewhere in your contacts is someone with a recipe blog, a forum handle with years of answers behind it, or a shop website they built themselves. Send them this. Section 2.3 was written with people like them in mind, and they deserve to know what's in it.

So read one of those records the way a federal judge in Oklahoma did.

One evening in May, Tulsa County Deputy Sheriff Freddie Alaniz, parked beside the highway, saw a Mazda SUV with a California plate and followed it "for no apparent reason other than the fact that it had a California license plate." He queried the plate in two systems, Flock and Motorola Solutions' VehicleManager, and both offered a field for a reason. In Flock, as a prosecutor later relayed in an email, he "inputted the reason as a traffic violation." In VehicleManager, "He inputted the reason as investigation."

Then comes the sentence the plate-reader ruling turns on: "At the time of those queries, all Alaniz knew was that the vehicle had a California license plate." His own report places the search "As the vehicle passed me" and a lane change "As I continued to drive behind the vehicle." He stopped the driver, Melisa Kyle, for following too closely, a stop the court found lawful. (Hold on to that.)

So the safeguard worked as designed — a reason went in, and the search ran. On Thursday, October 1, 2026, U.S. District Judge Sara E. Hill held that the search violated the Fourth Amendment anyway. Afterward, the sheriff's office told KFOR the deputy was still on duty and faced no discipline "because he followed policies," as the station summarized it.

So what did the judge decide?

I argued in September that the Supreme Court's June decision in Chatrie v. United States "is about geofence warrants" and had "not done anything to them yet," meaning plate readers. A district judge has now put it to work on them.

With no Tenth Circuit or Supreme Court ruling on plate readers, Hill reasoned from Chatrie, which held that accessing a phone's location history is a search, and from Carpenter, an earlier case whose warning Chatrie repeated: society never expected police to "secretly monitor and catalogue every single movement of an individual's car."

What did one query buy? The deputy's search "in just the ALPR system" (the opinion doesn't say which of the two) returned "more than 50 individual records of Kyle's whereabouts across the country for an entire month." How long that data is kept, and by whom, the court couldn't say.

That the movements happened in public, Hill wrote, is "not dispositive." What mattered was the breadth: "This is a type of indiscriminate mass surveillance." And she asked the question this whole debate circles: "why is it the government's business where everyone goes all the time?"

She granted the tools "remarkable benefits that the Court cannot ignore," then held that the query "was a search under the Fourth Amendment" and that, "Based on the information in the record, the only reason Alaniz conducted that search was because he saw her license plate was from California." It had no probable cause and no warrant. Everything "obtained after Alaniz initiated the ALPR search" was suppressed "as fruit of the poisonous tree."

That wasn't the only ground. The deputy kept the stop going after handing back Kyle's license, which the court held he lacked reasonable suspicion to do; on that ground alone, "all evidence recovered as a result of the stop must be suppressed." (One irony: her account of her trip was, the court noted, "bolstered by the results of Alaniz's ALPR search.")

A receipt, not a permission slip

The safeguard is real, and both companies describe it. Flock says "Every search creates a reviewable record, including who ran it, when they ran it, and the offense type." Motorola's VehicleManager brochure, filed by the defense in this case, says of its AI search assistant that "all queries are fully auditable for transparency." Oklahoma City's police chief told his council his department adds "a manual audit for possible improper searches every 30 days."

So what would an auditor have found here? A plate, a deputy, a time and a reason: "traffic violation" in one system, "investigation" in the other. Neither looks wrong on a log. A traffic violation did follow. And "investigation" is about as ordinary as reasons get: in an Electronic Frontier Foundation dataset of 11.4 million Flock searches over six months, more than 14 percent gave just that one word, the ACLU reports.

None of that is a scandal, and that's the point. A log is a receipt — proof that a search happened, and of what the officer said about it. It can't answer the court's question: may police pull a month of anyone's movements, without a warrant, because of where a plate came from? (Kyle's lawyers argued that "compliance with internal policy or state law is not decisive under the Fourth Amendment"; the court didn't need to decide that.)

When California made police disclose AI-written reports, I called the audit trail in that law "a capability the law creates." In Tulsa County, it's a product feature. Oklahoma's only plate-reader statute creates an "Uninsured Vehicle Enforcement Program," and KGOU calls plate-reader use in the state "a legal gray area." (Whether that statute limits a sheriff's searches is disputed, and the court didn't decide it.)

Does this make plate-reader searches unconstitutional?

Not as a rule, and Hill said so herself: "it appears that nearly every court examining the issue to date has determined that ALPR technology use is not a search," including three other federal courts in Oklahoma, one in her own district.

In March, the Fifth Circuit held that using a plate-reader system "did not constitute a search, so no warrant was required." Elijah Porter, the defendant, has asked the Supreme Court to hear what his lawyers call "questions of exceptional importance," and as of October 13, 2026, its order lists show no action. The government, answering only his separate gun-law question, agrees with his fallback request to hold the petition until the Court decides two Second Amendment cases. In January, a federal judge weighing Norfolk, Virginia's cameras wrote that "the answer is: not today." And Chatrie itself distinguished an older case partly because "the surveillance there was confined to public roads," which is where plate readers sit.

404 Media, calling the Tulsa ruling "one of the first times a federal judge has decided Flock searches can be unconstitutional," noted it "will not set a binding precedent." Because the extended stop independently doomed the evidence, an appeal could win on plate readers and still lose. And the government argued no exception to the exclusionary rule, so none was weighed.

Flock, which wasn't a party, says the ruling "goes against the overwhelming weight of authority" and expects it to be "appealed and ultimately overturned." (Motorola hasn't commented publicly that I could find.) The U.S. Attorney's Office, FOX23 reported, is "reviewing the court's decision and evaluating the next steps." As of the docket's latest update, no notice of appeal appears. The ordinary deadline to file one — thirty days, pushed past a weekend — runs to Monday, November 2 unless a court extends it, and Hill has a hearing set that morning, purpose unstated.

The tools do solve cases (Oklahoma City's chief credits them with 1,280 recovered vehicles and help in 60 murder cases), and audits do catch abuse: internal audits were credited in the majority of the alleged misuse cases InvestigateTV reviewed.

So whom did the Fourth Amendment protect here? The sheriff's May account, as KTUL reported it, began with the lane changes: a deputy "observed a vehicle make multiple illegal lane changes," and deputies "reportedly found 91 pounds of methamphetamine." Kyle was federally charged with possessing more than 500 grams of methamphetamine with intent to distribute; the opinion never says what the search found, she is presumed innocent, and her trial date has been struck. Meanwhile, California drivers suing Flock over data sharing heard a federal judge say in September that he was inclined to find they lacked standing: "A violation of the law is not, in itself, an Article III injury, as we all know." He signaled he would likely send the case back to state court. The exclusionary rule protects the person with evidence to suppress; a driver who can't show a personal injury may not get through the federal courthouse door at all.

Switzerland asks a different first question

What happens when a court asks who wrote the rules before it asks what the cameras saw?

Switzerland's Federal Supreme Court has been answering that since 2019, about cameras that read plates and check them against police search files. In a case from Thurgau, it held that such scanning requires "einer ausreichend detaillierten Regelung in einem Gesetz," a sufficiently detailed rule in a statute. (Translations from the German in this piece are ours.) Thurgau had none, so the recordings were unlawfully collected. Nor did public roads matter: recording the data there "ändert nichts" — changes nothing — about the constitutional protection.

Then the line that matters most for Tulsa County. The police's own technical concept, the "Gesamtkonzept AFV," capped storage at 30 days. The court called that "nicht von Bedeutung, da ihm kein Gesetzescharakter zukommt": irrelevant, because it has no force of law.

Set that beside the Oklahoma record. When the deputy searched, Flock's default retention, absent a state or local rule, was 30 days; in August its chief executive moved the default to "a 7-day retention," adding that "Existing customers will keep their current, democratically approved retention periods." Motorola's brochure tells agencies: "Set retention rules based on what works for you - not us." Settings, not statutes.

The rulings kept coming. In 2022 the court required Solothurn to have an independent body check the system periodically ("periodisch von einer unabhängigen Stelle") and tell the public what it finds. In 2024 it struck Lucerne's version, which let police keep everything, non-hits included, for up to 100 days. And on August 12, 2026, it struck Bern's clause keeping 60 days of data on drivers who matched no search file — "eine geheime anlasslose Massenüberwachung," a secret, suspicionless mass surveillance, without effective protection against abuse — and barred the system until immediate deletion of non-hits is written into law and logging of each specific search order into at least a regulation. Two days later Bern switched the system off, saying its police already met those requirements.

Seven weeks apart, Lausanne and Tulsa reached for the same idea: "anlasslose Massenüberwachung," "indiscriminate mass surveillance."

None of this means Switzerland banned the cameras. The Bern ruling struck parts of the law, not the system, and Bern's security director has asked the court to allow it again for homicides, rapes and kidnappings before the law is fixed. The Swiss remedy is also narrower: unlawfully gathered evidence can still be used where "zur Aufklärung schwerer Straftaten unerlässlich," indispensable to solving serious crimes. Thurgau's case, in one Swiss law firm's English summary, involved "driving without authorization." A 91-pound drug case might have come out differently there. So the useful comparison is who writes the rules, and whether anyone writes them down before the cameras go up.

Now let software fill in the reason

This part is my extrapolation, not a report on any agency's plans.

Hill went there first: it is "no longer difficult to imagine law enforcement using a fleet of drones hovering over an entire city so they don't miss the movement of a single vehicle. This is not hypothetical catastrophizing."

Now give the first look to software. Flock "now alerts law enforcement when suspect vehicles have been identified in multiple states over the past 30 days," a 2025 trade report said (nothing here says Tulsa County uses it). From the plate search, the deputy wrote, the car "appeared to have made a very quick turn around travel to the western part of the country." Picture software flagging that pattern before any deputy sees the car. The log will still want a reason. Whose?

Both vendors also sell search by description. Motorola's brochure: "Simply type a description of the desired vehicle." When a search starts from a description, what does a reason box attach to?

And the rules arrive by blog post. Flock added "a mandatory Offense Type dropdown" in late 2025 and promised case codes by the end of 2026. Switzerland's court set the opposite principle in 2022: new software with functions the law doesn't provide for "dürfen nicht ohne Gesetzesrevision eingesetzt werden," may not be used without amending the law. Here, the next capability can ship in an update. There, it waits for a vote.

The clock may also run faster than I estimated in September, when I called this "a 2029 or 2030 Supreme Court case at the earliest." The Seventh Circuit heard arguments over Illinois's highway cameras on September 29; the Fourth Circuit has Schmidt v. Norfolk tentatively calendared for the week of December 8 (it may move). Imagine the question reaching the justices years early. I won't guess their answer.

An odd coalition, and the people across from it

On the civil-liberties left, the ACLU's Jay Stanley argues that logs depending on officers' self-reporting are "not an adequate check" (though "none of this means that we think companies ought to remove logging"), and the Electronic Frontier Foundation calls the one-click reason dropdown "a loss for transparency" and wants "an ironclad warrant requirement."

The right has landed nearby. The American Enterprise Institute's Jim Harper writes that "Through Flock, Kansas maintains an ongoing search for the location of everyone all the time." Michael Soyfer of the libertarian Institute for Justice, which represents the residents suing Norfolk, told 404 Media the Tulsa opinion recognizes "the sheer breadth of these systems." Sen. Josh Hawley (R-Mo.) has announced a Stop Flock Abuse Act under which "a written approval process must log every authorization for a search." And Oklahoma Republican Rep. Tom Gann has said the data "is being used well beyond what the law allows."

Across from them, the Major County Sheriffs of America say plate-reader use "does not constitute a Fourth Amendment search," the United States and seventeen states back Norfolk in the Fourth Circuit, and Oklahoma City's mayor, David Holt, has said "there is no expectation of privacy in public." Flock, for its part, wrote ahead of a September Senate hearing that the rules "should be set by law." At that hearing, Sen. Dick Durbin (D-Ill.) put the task plainly: "We have got to find a way to balance in America privacy and security."

GW Law's Andrew Ferguson calls the Tulsa case "a direct result of Chatrie." On September 14, UNC's Jeff Welty wrote, "As far as I know, no court has ruled that the use of Flock cameras violates the Fourth Amendment," and predicted "a major legal clash." Seventeen days later, one did. The split, in other words, runs less between left and right than over whether the Constitution has anything to say about a month of your drives.

What does this mean for you?

• Find out what your police run, and what they publish. Flock says "More than 1,500 agencies have published a Flock Transparency Portal." Not every agency does: a resident's records request found that Oklahoma City's police do "not publish internal use or transparency reports on Flock."

• Ask your council or oversight board five questions.

  1. How long is our data kept? Flock's new default is seven days, but existing customers keep their old periods. Oklahoma City is cutting its own from 30 days to seven, its chief said in August.

  2. Is national sharing on? Oklahoma City is pulling its data from a nationwide sharing platform.

  3. Does every search need a case number, and does anyone approve it first? Flock says it will "require case codes for all law enforcement searches by the end of the year." In July, Oklahoma City's case-number rule was "internal guidance," and "not official policy."

  4. Who outside the department reads the audit log, and does the public see the results? Switzerland's court requires both.

  5. Which state law governs this? NCSL counts "at least 28 states" with statutes on plate-reader use or data retention, and at least 18 that require audits, reporting or oversight. Its table lists Oklahoma: "No statute identified."

• If you're stopped and an officer asks to search your car, the ACLU of Texas says "you can refuse," though police with probable cause can search without your consent. Kyle refused. She was held anyway, and a court found that unlawful months later. Don't count on that ending.

• Mark Monday, November 2, 2026. It's the government's ordinary deadline to appeal and the day of a hearing in the case. The Fourth Circuit's tentative argument week in Schmidt v. Norfolk starts December 8.

The lesson, as I see it

A reason box records what an officer says about a search. It can't tell anyone whether the search should happen, and in Tulsa County it didn't try: it took "traffic violation" and "investigation," and a month of someone's movements came back. The next search may start with an alert no deputy asked for, and the box will be filled in just the same. Switzerland's court, ruling after ruling, has insisted that the limits have the force of law — before the cameras run, with someone independent reading the logs. Even Flock says the rules belong in law.

My vote? Put the limits where the Swiss put theirs: in a law a legislature passed, with short retention, independent review of the logs, and a judge's signature before anyone opens a month of a stranger's drives. Until then, a reason box is a receipt, not a permission slip.

Someone on your city council votes on these contracts; someone on a police oversight board can ask to see the logs. Bring them the five questions above. They're easier to ask before a renewal vote than after one.

Long before that answer reached you, people were paid to write the prompts, improve the answers and rank them. The training papers of four big labs all describe them. OpenAI's 2022 InstructGPT paper credits a team of about 40 contractors "on Upwork and through ScaleAI." Anthropic's that year describes crowdworkers hired on MTurk and Upwork. Meta's Llama 2 paper had annotators write a prompt, then choose between two sampled model responses. Google DeepMind's Sparrow paper used paid annotators to assess model responses.

Scale AI runs a platform for this work, Outlier, and its FAQ puts the job plainly: you "may generate prompts, rank AI outputs, improve model responses." Pay is weekly, rates "vary by expertise, project complexity, and location," there are "no minimum hour requirements," and the classification comes up front: "You'll work as an independent contractor/freelancer, not as an employee of Outlier."

A court notice in San Francisco has its own names for these people: "Generative AI Annotators, Prompt Engineers, Subject Matter Experts, Contributors, or similar positions." Those who did that work on Scale's platforms, Outlier and Remotasks among them, while living in California between December 10, 2020 and February 28, 2026 are the class in a proposed $12.5 million settlement of suits accusing the companies of misclassifying them as independent contractors. If a judge approves it, they would be paid, and none of the contractors' money would count as wages.

If you rated answers on Scale's platforms from California, this is about your money. If you have only ever clicked a thumb, it is about how the thing you clicked was made — and who answers for the people who made it.

Who gets what, if the judge says yes?

"Scale AI" is shorthand. The defendants are Scale AI, Inc.; Smart Ecosystem, the subsidiary that does business as Outlier; HireArt, which placed some workers at Scale; and four individuals, including Alexandr Wang. The class covers only people who did the work "while residing in the State of California," plus HireArt's placements who lived there. By the defendants' estimate, that is about 15,333 people who worked as contractors, with roughly 118,844 paid workweeks between them, plus about 144 placements. Outlier, for comparison, claims "900K+" trainers.

Class counsel may ask for up to one-third of the $12.5 million ($4,166,666.67) in fees. Take out expenses, payments to the named plaintiffs and the administrator, and penalties under a state labor law (65% of them to the state), and an estimated $7,543,333.33 would be left, shared out by paid workweek. My arithmetic on the defendants' estimates, not a figure from the notice: roughly $63 per paid week, or about $490 per contractor on average, and the average contractor was paid for work in fewer than eight weeks. Treat those as rough: the counts date from mid-2025, and real checks would depend on your weeks and on what the judge approves.

How would the money be booked? Both sides are asking the court to approve "an allocation of 100% of the Individual Class Payment to non-wages" for the contractors, reported on an IRS Form 1099 "if required by law." HireArt's placements would get 10% of theirs as wages, on a W-2. The defendants would owe employer-side taxes only on wages — so on none of the contractors' money. The deal draws the very line the suits attacked. To be fair, a 1099 is a reporting form, not a verdict: California's Labor Commissioner says being paid on one "does not determine employment status."

Nothing has been decided about who was right. The companies "strongly deny violating any laws" and maintain "that Contributors are independent contractors," and the court "has made no determination" on the merits. Granting preliminary approval on May 7, 2026, Judge Ethan P. Schulman called the settlement "a compromise of the Parties' respective positions rather than the result of a finding of liability at trial."

What would class members give up? All claims from the class period "that were asserted, or reasonably could have been asserted, based on the facts, allegations and/or claims" in the suits, including "Willful Misclassification of an Employee as an Independent Contractor," against the defendants and "Released Parties" that include their "customers (only as it pertains to work performed for the customers through Defendants), investors." (Yes, investors.) The notice names none of them.

What wouldn't change? McKinney's original complaint sought "changes to Scale's worker classification model," SFGATE reported. The agreement — "the entire agreement," by its own terms — contains no term that reclassifies anyone or changes how the platforms pay. Outlier's terms, effective May 11, 2026 (four days after preliminary approval), still say you are "an independent contractor of the Company" and that you "assume all liability for proper classification."

As of October 13, 2026, the settlement website still says the court "has not yet decided whether to grant final approval", and the hearing is set for October 30, a date the notice warns could move. The defendants may also withdraw if more than 50 people opted out, a count that isn't public.

When the timesheet becomes the evidence

On September 29, Bloomberg Law counted at least five misclassification suits from AI trainers pending in California courts and one in Texas. Under California's ABC test, a worker is presumed to be an employee unless the company shows, among other things, that the person "is free from control and direction." So plaintiffs are turning the industry's own software around, pointing to continuous monitoring, automated scheduling and performance metrics as proof they lacked a contractor's independence.

Mercor, which staffs AI trainers, tells its contractors, "You are paid weekly based on the hours you work, which are tracked using Insightful." A federal suit in Texas, White v. Mercor, says it misclassified more than 30,000 workers, and, in a management-side law blog's summary (the author's firm, Littler Mendelson, represents HireArt in Scale's case), alleges that Mercor "fails to pay experts for work completed outside of the tracking app." Mercor asked the judge in June to send the case to arbitration; White amended her complaint about two weeks later, and as of October 13, 2026, the public docket shows no arbitration ruling.

A California suit, Cox v. Mercor, names OpenAI as a defendant; a legal-data site's summary says the suit alleges Mercor and OpenAI jointly employ and control the workers. It is the only one of these suits I could find that names a lab, and its current status is unclear.

A check now, or a fight in arbitration?

Before deciding that $490 is too little, look at what the workers faced instead.

No court ever certified a class to litigate these claims, and the companies maintain the claims are "subject to binding arbitration agreements." Outlier's current terms send U.S. claims to individual arbitration unless you opt out. Against that, a fund that can't revert to the companies and pays out without a claim form is a real result, and the judge found that the deal "appears at this stage to be fair, reasonable, and adequate."

The companies' case on the merits deserves a hearing too. Scale has said that "Hundreds of thousands of people use our platform to showcase their skills and earn extra money," and that it works to make its pay meet or beat local living wage standards. (That average of under eight paid weeks is a number both sides could use.) And the federal Labor Department dropped its investigation of Scale in May 2025; "It's not clear exactly why," TechCrunch reported.

In short, the case for the deal is strong: money now, for people who might otherwise have faced one-by-one arbitration over small sums. But it settles what one California group is owed for one stretch of time, and it leaves the question the suits were filed over — employee or contractor — where it was, for the class and for everyone who signed up after February 28, 2026.

Kenya took the question to the top of the chain

What happens when outsourced workers go after the company at the top? Kenya has been finding out in open court.

The best-known cases involve content moderation, not AI training. Facebook moderators who worked through an outsourcing firm, Sama, sued Meta and its contractors in Kenya's "Employment and Labour Relations Court," testing, in TIME's framing, whether a Big Tech company can be sued in Kenya for alleged abuses at an outsourcing company. Both companies deny wrongdoing, and Meta's companies argued they were foreign and "not carrying on business in Kenya." On September 20, 2024, the Court of Appeal dismissed their appeals: whether they employed the workers "is an issue of fact which ought to be reserved for the hearing of the petition." The same day, it set aside in its entirety a 2023 ruling that had treated the Meta companies "as the primary and principal employers of the Content Moderators." So the cases can be heard, and who the employer was remains open. (Toussaint Nothias of NYU says the no-business-here argument shows how tech companies can be "both fully present and strategically absent.") On September 29, 2026, Meta and two companies linked to its moderation work got 21 days to respond in one case, and the parties are due back on November 9 for further directions.

Kenya's politicians have pulled the other way. Opponents argue that holding Big Tech liable for what happens at its contractors would make Kenya less attractive to foreign firms. In December 2024, President William Ruto said "we have changed the law, so nobody will take you to court again on any matter." TIME reported that the bill would not do that, and that its text "instead explicitly prevents outsourcing companies' clients" from being drawn into such suits. (Meta said it "has not advocated for changes to these laws.") The bill would make the outsourcing firm "responsible for any claim raised by an employee." It passed the Senate and was amended by the National Assembly, and the Senate's motion to consider those amendments was deferred on October 6 and again on October 8, when the Senate adjourned until November 3. As of October 13, 2026, it is not law.

AI-training work has its own record. In 2023, Kenyans who had labeled data for OpenAI through Sama filed a petition before the country's lawmakers; no outcome has surfaced. TIME had put their take-home pay at between around $1.32 and $2 per hour, against the $12.50 hourly rate in OpenAI's contracts with Sama. Sama said that rate covered all costs and that workers could earn between $1.46 and $3.74 an hour after taxes; Kenya has no universal minimum wage (a Nairobi receptionist's was $1.52 an hour at the time). OpenAI called the workers' efforts "immensely valuable." Scale's own Remotasks paid Kenyans per task, and workers told 60 Minutes they sometimes went unpaid; Scale said work "in line with our community guidelines was paid out." Then, giving no reason, Remotasks told Kenyan users it was "discontinuing operations in your current location," effective March 8, 2024. 60 Minutes placed the exit "as workers started complaining publicly"; local reporters floated other potential reasons, such as account selling. Kenyan data labelers have also formed the Data Labelers Association to organize workers to fight for better pay.

In Kenya, then, whether the company at the top answers for outsourced workers is being argued in open court, and so far Meta is still in the case. In California, the McKinney release, if approved, would take that question off the table by contract for one class, releasing the defendants' customers (for this work) and investors. The counterpoints are real: jurisdiction is not liability, Kenya's Senate passed a bill TIME read as shielding clients, pay looks different against local wages, and American workers can name the client too, as Cox does.

The next settlement, imagined

This part is my extrapolation from documents on file, not a forecast about any company.

Say you sign up in 2027 to write hard questions in your field and grade a model's answers. You click to accept terms that send any dispute to a private arbitrator unless you email an opt-out within 30 days. (Would you think to?) The tracking app that sets your pay becomes — the day you claim you were an employee — the best evidence on both sides: of how closely you were managed, and of how much you worked.

Now multiply you by thousands. If few opt out, the next wage fight may be no class action at all, but a scatter of private arbitrations that never add up to a public number. If a class case does get through, McKinney's release could become the template, letting go of the customers whose models the work was for. And a rater doing the same task for the same model from Nairobi, through an outsourcer, might be able to name the lab in court, or might be told only the outsourcer answers, depending on a Senate vote and a Kenyan trial yet to decide who the employer was. One model, two countries — two answers to who is responsible.

Where the lawyers on both sides agree

In Bloomberg's reporting, lawyers on both sides look past the legal test to the evidence, and the workers' side to the forum too. Shannon Liss-Riordan, a plaintiffs' lawyer, says "defendants became very proficient at blocking these decisions from ever reaching in the courts through their use of arbitration clauses." Miriam Cherry of St. John's University expects the companies' data to be "one of the flash points in these misclassification suits."

Paul DeCamp, a management-side lawyer who was the Labor Department's wage and hour chief under President George W. Bush, says the cases won't necessarily be clear-cut. The question, as he frames it, is whether a worker sees this as a job or as a way to "receive what amounts to pizza money or an honorarium, as opposed to making a living." The tracking data, he told Bloomberg, could cut both ways if there's evidence plaintiffs overstated their work and hours. Orly Lobel of the University of San Diego names the question underneath: "who is actually controlling and economically organizing the work?"

The think tanks split along familiar lines. The labor-aligned Economic Policy Institute says misclassified workers are "stripped of minimum wage and overtime protections." A working paper from the libertarian-leaning Mercatus Center found that after AB5, the law behind California's ABC test, self-employment decreased "by 10.5 percent on average for affected occupations" (an association, not proof the law caused it).

What does this mean for you?

• If you did Outlier or Remotasks work (or a HireArt placement at Scale) while living in California between December 10, 2020 and February 28, 2026, you're probably in the class. There's no claim form; the September 3 deadlines to opt out, object in writing or dispute your weeks have passed. If you didn't opt out, the notice says you can still object at the hearing, in person or by video.

• Mark October 30, 2026, 9:00 a.m., Department 304, 400 McAllister St., San Francisco. Check the settlement website first, since the date can move, and keep your address current with the administrator, Simpluris, at (833) 234-6281.

• Cash the check before it expires; the void date will be at least 180 days after mailing. You're bound by the release either way, though it reaches only claims from the class period that grow out of the suits' allegations, so work after February 28, 2026 falls outside it.

• If the allocation is approved, a contractor's share would be reported on a Form 1099 "if required by law," not a W-2, so plan for the tax: the notice says the taxes are yours. Ask a tax professional.

• Wherever you live, check which tax form you get and whether every hour is paid, including onboarding, instructions, meetings and time outside a tracking app. Keep your own records.

• In California, you can file a wage claim with the Labor Commissioner, report violations affecting a group of workers, or submit a "Request for Preliminary Worker Classification." Retaliation is prohibited, and state law can treat you as an employee even when federal law doesn't.

• Anywhere in the U.S., the IRS's control test applies even if the worker can choose to work remotely. You can ask the agency to rule on your status with Form SS-8 (it may take at least six months), and if you qualify, Form 8919 lets a misclassified worker report the employee's share of Social Security and Medicare tax. Both concern platform pay, not the settlement check.

• Read the arbitration clause before you click accept. Outlier's lets you opt out within 30 days by emailing a notice yourself, without retaliation, though opting out doesn't undo earlier agreements.

The lesson, as I see it

A settlement puts a price on a question without answering it. This one would pay about 15,000 Californians a few hundred dollars each on average — none of it as wages — and release the companies, and their customers for this work, from misclassification claims.

What should you watch? October 30, and whether the motion for final approval appears on the settlement site before it. Whether White's case goes to arbitration. In Nairobi, the November 9 directions, and the Senate's deferred motion once senators return on November 3.

My vote? If a platform's software can log every minute of the work, the platform can pay for every minute of it, and the next settlement in this field should say in writing what the workers are going forward, not only what they're owed for the past. The people who taught chatbots to answer deserve a straight answer of their own.

Anyone who grades a machine's answers for a living deserves a plain reading of what they signed. Helping the public read AI's fine print is the point of the HAIA Foundation; for the next close reading, subscribe.

The same four companies put their names to a second document, dated and filed on October 6, 2026: a proposed settlement with Duke Energy over how North Carolina should charge its biggest new power users. (Meta signed through a subsidiary, Andale LLC.) This one has a cutoff date. "This tariff applies to all letter agreements (LA) and electric service agreements (ESA) executed on and after June 1, 2026, for Large Load Customers," the attached tariff begins. A few lines down: "An ESA that is initially executed prior to June 1, 2026 that is subsequently renewed, extended or assigned pursuant to the terms of the ESA shall not be subject to this tariff."

So what happens to a data center that signed its service agreement with Duke in, say, April? By the deal's own terms, the new rules don't reach it (with one exception for big expansions, which I'll come to).

I want to be fair to both documents. The pledge was voluntary from the start (the word is in its text), and the settlement asks more of new data centers than Duke's current rate does. But read October against March, clause by clause, and the promises turn into questions — who pays for the power plants, who pays for the wires, and which customers count as new.

What the four companies promised in March

What else did they sign up for? One more commitment matters here: "Companies will voluntarily negotiate new, separate rate structures with their utilities and relevant State governments wherever they build data centers," and pay those rates "whether they use the electricity or not."

Each company spoke for itself in a White House release the next day. Amazon said the commitments "establish an important baseline that will protect ratepayers." Google said its support "affirms our long-held commitment to protect energy affordability for American households." Meta said the pledge "ensures families aren't the ones footing the bill for AI's energy consumption." Microsoft called it "an important step" and credited the President's leadership "to ensure that data centers don't contribute to higher electricity prices for consumers."

On July 23, Duke Energy joined the pledge. North Carolina's attorney general, Jeff Jackson (a Democrat; the pledge is a Republican administration's), answered the same day: "a promise in Washington doesn't lower a power bill in North Carolina. We're calling on Duke to make that same promise to the Utilities Commission, in writing, where it can be enforced."

In June I wrote that "A press release is not a tariff." Neither is a pledge. On October 6, North Carolina got a proposed tariff. So what does it say?

What the October 6 deal asks of a new data center

Who signed? Duke's two North Carolina utilities; the Public Staff, the state's utility consumer advocate; Amazon Data Services, Andale, Google and Microsoft; an industrial customers' group; and the Defense Department with other federal agencies.

Who's covered? Customers contracting for 50 megawatts or more with an expected load factor of 80 percent or higher, or for 150 megawatts or more at any load factor. (Load factor measures how steadily a customer draws power; round-the-clock users score high.)

Who isn't? Any service agreement first signed before June 1, 2026, even when it is later renewed, extended or assigned to another company under its own terms. And any customer "already receiving service as of June 1, 2026" that signs a new agreement afterward. The one carve-back: an expansion added on or after June 1 that "by itself" meets the size and load-factor tests is covered, even for a customer the rest of the tariff exempts.

Which rate? "The customer will be served under Schedule HLF." The deal, as WFAE put it, "repurposes an existing tariff, making it compulsory." HLF is open to any customer "with a kilowatt demand of 1,000 kW or more" — one megawatt, a fiftieth of the smallest customer this tariff covers. Duke calls it "a separate rate established for large loads." It is separate from what households pay — but not from what a one-megawatt factory on the same schedule pays.

What does it add? Real obligations, most of which Duke's existing rate lacked:

• A minimum bill from the start. Billing demand "will not be less than 75% of contract demand," so a customer that contracts for 100 megawatts pays the capacity part of its bill (not the energy part) on at least 75 — whatever it draws. HLF already had that 75 percent floor from a new installation's 13th month; the deal applies it "as soon as contract demand is in effect." The Public Staff had raised its own proposal from 75% to 80% "after reviewing the national average," a coalition of consumer and clean-energy groups says in its reply comments, and the governor's energy task force put the national median at 80% as of late 2025.

• Equipment for one customer, paid in advance, within 60 days of the letter agreement.

• Shared upgrades, secured rather than paid. For transmission upgrades on the wider grid, the customer posts a letter of credit for their estimated cost. In WFAE's description, those costs "would be spread across all customers in the beginning, and paid back over the course of the data center's contract with Duke." If the customer leaves early, Duke draws on the credit for what's left of the upgrades' book value.

• Long contracts, and a price for leaving. Minimum terms of at least 10 or 15 years by size (HLF asks for one), two to four years' notice, and exit damages in three parts: every minimum bill and facilities charge through the notice period, the present value of remaining facilities charges, and "25% of remaining minimum billing demand charges" after that. In Duke's illustration, a 500-megawatt customer leaving with no notice in its fourth year would owe about $587 million, and must post security to match.

What does it leave for later? Two of the three promises above. Whether large loads get a class of their own, and how the cost of new power plants is shared, wait for "the next rate base rate case," where Duke will study costs "with and without the use of separate large load class" and every party stays "free to assert their respective positions." WFAE reports that rate case "could be two years from now."

Where does it stand? As of October 13, 2026, it's a proposal awaiting the North Carolina Utilities Commission's approval, and Duke says "a decision is expected by mid-November." If approved, it would apply to service from January 1, 2027.

Isn't grandfathering normal?

It is — and that's the strongest case for this deal.

Rules that change what people pay usually apply going forward. The version of Senate Bill 730 that North Carolina's House passed would apply only to data center agreements "entered into on or after" the day it became law. Even the coalition fighting this deal proposed sparing existing customers one thing, direct charges for new facilities, because "Longstanding customers do not trigger the same load and cost growth concerns as new very large customers."

According to that coalition's summary of the record, the Defense Department and others asked to protect existing facilities, and Duke and Microsoft their recently closed deals. Duke warned of "prohibited retroactive ratemaking"; Microsoft and the Carolina Utility Customers Association cited the Constitution's Contracts Clause, though Microsoft acknowledged, the coalition notes, that the commission may change rates going forward even when that alters existing contracts.

Duke says contracts signed before June 1 "contain a full suite of similar customer protections." The cutoff reaches back four months before the filing. The new terms are a real step up from a one-year rate with no security. The Public Staff signed, and the Environmental Defense Fund's Will Scott called the deal "a step in the right direction towards making sure data centers pay the cost of grid upgrades they cause, but it fails to do the same for new power plants."

So what's the problem? Three things the fairness argument doesn't reach.

First, you can't check the word "similar." Duke's existing deals are "confidential, one-off service agreements," as Canary Media put it. Harvard Law School's Ari Peskoe and Eliza Martin warned last year, about utilities nationally rather than Duke, that "secret contracts between utilities and data centers" could be "transferring Big Tech's energy costs to the public."

Second, timing. In a filing WFAE reported on June 8, the Public Staff urged the commission to act now because many energy-intensive businesses had already signed contracts with Duke Energy for future service. The deal it later signed (yes, the same Public Staff) leaves pre-June agreements outside the tariff, and says its terms reflect "compromise" — not any party's position.

Third, the pledge itself. Its first commitment (new generation, paid at full cost) and its third (new, separate rate structures) are the two things this deal sends to the next rate case.

Wisconsin and Minnesota wrote it into the rate

What does it look like when regulators put those promises into the rate itself? Two Upper Midwest states have done it, with utilities that signed the same pledge as Duke: WEC Energy Group, which owns We Energies, and Xcel Energy.

In Wisconsin, the Public Service Commission struck an option that would have let data centers "only pay for 75% of the costs of generating facilities" (a different 75 percent from North Carolina's; this one is a share of power plant costs). Its final decision, issued May 21, 2026, makes We Energies' very large customer tariff mandatory at 100 megawatts and up, "ensuring that a distinct customer class is created," and bills transmission on at least "100 percent of initially forecasted load." In Wisconsin Watch's summary, the utility must "bill data center customers alone for power plants built to serve them." The decision has held: a petition to reopen it was denied by operation of law in July, and Oracle dropped its court challenge to the financial requirements in August; a spokesperson said the company stands by a commitment to pay its own way for power.

Minnesota started with its legislature. Its 2025 data center law, signed June 14, 2025, orders regulators to define "a very large customer class or subclass for each public utility" by December 15, 2026, and to weigh how best to see "all costs attributable to the utility's very large customers" assigned to it. Ruling on Xcel Energy's tariff in May 2026, the Public Utilities Commission created "a standalone customer class" for new loads of 100 megawatts or more, raised the minimum bill and exit fee to 80 percent of contracted capacity, and ruled that "All transmission and distribution upgrades needed to serve very large customers must be paid directly by those customers," where North Carolina's deal takes a letter of credit for shared transmission upgrades.

Now the fair counterpoint: Minnesota grandfathers too. Its statute "shall not apply to existing, renewed, or extended electric service agreements" of very large customers, or to those served before 2020. What differs is where the protection lives: in Wisconsin and Minnesota, in a class of its own with cost rules written into the rate; in North Carolina's deal, in contract terms on a shared, existing schedule. North Carolina's exemption also reaches further, naming assigned contracts and any customer already served on June 1, 2026 that signs a new agreement, where Minnesota's customer exemption stops at those served before 2020.

Picture a spring-2026 contract in 2036

What follows is my extrapolation from the text, not a forecast about any company or site.

It's 2036. A campus whose service agreement with Duke was signed in spring 2026 has been sold, and the agreement assigned to the buyer and extended as its terms allow; under the settlement's wording, it stays outside the tariff. Across the road, a campus that signed in July 2026 pays on the tariff's terms. Same grid, two rulebooks — and because the older contract is confidential, you can't see which one is gentler.

Then comes the rate case where the class question finally gets argued — possibly the first for a single Duke utility, since Duke Energy Carolinas and Duke Energy Progress combine on January 1, 2027. The settlement doesn't say whether a new class would reach the pre-June contracts.

Here is where things get interesting: none of that is locked in. The settlement binds no one unless the commission accepts all of it. The commission's own model schedule from August, as the coalition's filing reproduces it, had an independent assessor reporting to the commission set a deposit covering upgrades and a share of new generation. Picture its order pulling the deal toward that draft.

Libertarians and environmentalists agree on one thing

Who's right about the pledge? On one point, the libertarian right and the progressive left agree. "There's no enforcement," Travis Fisher of the libertarian Cato Institute said in The Hill; the Sierra Club, in a Guardian report republished by Mother Jones, called it "a paper-thin commitment." The Taxpayers Protection Alliance saw the same feature as a virtue, calling the pledge's voluntary nature "a welcome and sensible approach."

Where they part is the fix. Jon Sanders of the John Locke Foundation would let data centers "supply or contract for their own power independent from the grid," shielding everyone else "without requiring special contracts and terms with the utility" (Carolina Journal, which reported it, is the foundation's news service). R Street's Devin Hartman and Kent Chandler name the main hurdle: cost-of-service utilities, "whose business model depends on socializing costs and risk."

On the consumer side, Jackson argued in a filing with the commission, his office said the day the settlement was filed, that data centers should be in a separate rate class and be allowed to build and generate their own clean energy (on that last point, he and the free-market think tank aren't far apart). The Southern Environmental Law Center's Nick Jimenez said the deal includes "many of the right protections, but in forms that are far too lenient." From the center, Brookings notes that "only elements of the ratepayer protection pledge have been enacted into state law or regulation and only in select states."

Duke's case, from its North Carolina president, Kendal Bowman: "It's simple – data centers will pay upfront for all costs to connect to the grid." (Up front for single-customer equipment; a letter of credit for shared upgrades.)

Different fixes, one diagnosis: a promise without a mechanism leaves the bill where it was.

What does this mean for you?

• If you're a Duke customer in North Carolina, put your view on the record. The commission lets consumers "submit comments about any docketed matter." The dockets are E-7, Sub 1329 (Duke Energy Carolinas) and E-2, Sub 1380 (Duke Energy Progress). Statements join the record after two or three business days, and the commission says it considers them.

• Read the two clauses yourself: the "Applicability" paragraph on the first page of the settlement's Exhibit 1, and section II.B.6 on page 8.

• Ask whether the old contracts will ever see daylight. The House version of Senate Bill 730 would require each data center contract signed from the day it takes effect (not the old ones) to be filed with the commission within 30 days, though either side could still mark all or any part of it confidential, to the extent the law allows. As of October 13, 2026, it sits in the Senate Rules Committee, awaiting a vote on the House's changes that can come once the legislature reconvenes October 26. Tell your state senator what you think.

• Elsewhere, check two lists. Is your utility on the White House's pledge list? Does your state have a large-load tariff? By the utility industry's count, 25 states had approved at least one large load tariff as of September 2026, with 7 more pending.

• Whenever someone cites the pledge, ask which tariff enforces it. Which rate schedule, which class, and who pays for the new generation?

The lesson, as I see it

The pledge's first promise covers the companies' "new energy demands." The first thing North Carolina's deal decides is what counts as new, and its answer is a date. A data center that signed its service agreement in April and won't draw power for years is, for this tariff, old — and the class and the power plants wait for a rate case that could be two years off.

The deal isn't nothing, and I won't pretend otherwise: fifteen-year terms, real exit costs and posted security are more than Duke's current rate asks of anyone. But the four companies that promised in March to keep costs off "the ordinary household" signed this deal in October — and for every contract signed before June 1, its answer is that you'll have to take Duke's word for it.

What should you watch? The commission's order, which Duke expects by mid-November; Senate Bill 730 after October 26; Minnesota's December 15 deadline; and the federal Ratepayer Protection Act, stalled in the Senate since September 30 (no action as of October 13, 2026).

My vote? If the protections in the pre-June contracts really are "similar," let the commission see enough of them to say so in public, and give very large loads like data centers a class of their own now rather than after the next rate case. Two states have already done it, with utilities that signed the same pledge.

Pledges are written in adjectives. Tariffs are written in dates. Read the dates.

That piece also admitted what it couldn't settle. The law's duties fall on a "deployer," meaning "a person doing business in Colorado" — an odd description of a county office. So it told you to "Ask the question nobody has answered: does 'person' include a county?" And it warned: "If the rulemaking does not close that gap, nothing will."

The question did reach the state. The Colorado Department of Law, the Attorney General's office, says it "received several comments asking for clarification as to whether the ADMT Act applies to governments." (ADMT is automated decision-making technology; the law is Senate Bill 26-189.) On October 6 it answered, in a cover page released with its draft rules: "the ADMT Law does not apply to governments." Then the consolation prize: "However, the DOL would encourage governments to comply with the ADMT Act to the extent they provide essential government services such as Medicaid."

So I owe you an admission. I framed the choice as the rulemaking closing that gap or nothing closing it. There was a third possibility, and it's the one that arrived: an answer that sits beside the rules rather than in them, tells governments they're out, and binds no one. As the September piece said of the August drafts, "These are proposals; they bind nobody." That goes double for a cover page.

What the Department said, and where it said it

The Department released an interim draft of its rules on October 6, and the 75-page draft never says whether governments are covered. The answer lives only in the cover page, which rests it on two definitions, "Deployer" and "Person," and which says plainly that "the interim rules are not final."

So what do those definitions say? SB 26-189, which Gov. Jared Polis signed in May, puts its duties on a deployer, "a person doing business in Colorado." Only the Attorney General enforces it, under the Colorado Consumer Protection Act, which defines "person" as "an individual, a corporation, a business trust, an estate, a trust, a partnership, an unincorporated association ... or any other legal or commercial entity." No government appears on the list. (Whether a county squeezes into "any other legal or commercial entity" is precisely the legal question.)

Now set that beside who decides your benefits. Colorado's 64 county human services departments decide Medicaid eligibility as "agents of the state," and each is "responsible for determining eligibility" for food assistance, too. Federal rules require a public agency to make the call: Medicaid eligibility may be delegated "only to a government agency" with merit-system staff, and under the food-assistance rules, "Volunteers and other non-State agency employees shall not conduct certification interviews or certify SNAP applicants." For Medicaid and SNAP, the decision itself stays in government hands.

So who is left inside the law? Maybe the contractors. The state contracts with a private vendor to operate the Colorado Benefits Management System, "the technology platform that counties use to determine eligibility for various public benefits," in the words of the Colorado Center on Law and Policy, a legal-aid policy group. But the statute's duties for developers run "to each deployer," and the interim rules say that when a third party runs the software for a deployer that makes the decision, the deployer stays "responsible for fulfilling all Deployer obligations." If the county isn't a deployer, does the vendor owe anything to anyone? Neither document says. Treat it as a question for the comment period.

Medicaid also sits near a second door. The statute's core sections "do not apply to a covered entity" under HIPAA, the federal health-privacy law, whose rules count "the Medicaid program" as a health plan, and Colorado's Medicaid agency calls itself "a health plan and therefore a covered entity." (It also says the counties doing eligibility work are not its business associates.) The cover page's Medicaid example mentions none of this.

One October change reaches every deployer. The August draft required a disclosure to describe "the principal reason(s) for the Adverse Outcome" and, where a score was among those reasons, said it "shall disclose the Consumer's score." The interim draft would drop both in favor of a specific description of the software's role.

Then why was the state budgeting to comply?

The Department's reading would be less striking if the rest of Colorado's government had shared it. Under the 2024 law, whose deployer was likewise "a person doing business in this state" and which already reached "an essential government service," it didn't.

• September 2025. The governor's technology office told legislators that a list of state AI systems covered by that law "does not exist" because the law was unclear, so it was reading the scope broadly "to ensure compliance."

• December 2025. The office asked for $5.2 million "on behalf of all state agencies" to comply. The departments listed included Health Care Policy and Financing, Human Services and (yes) Law.

• March 2026. Legislative budget staff recommended denial (a recommendation, not the committee's decision) and wrote that "A fundamental divergence appears to exist" between executive and legislative readings, which staff traced to how broadly the executive read "artificial intelligence system"; in staff's account, "the sponsors understand the requirements to be much less onerous on state agencies." Less onerous, not inapplicable.

• May 2026. The Colorado Sun reported that the new bill would require "businesses, schools and governments that use AI" to offer ways to appeal. The deployer definition never changed between the bill as introduced and the one Polis signed.

• September 2026. The legislature's nonpartisan fiscal note for the new law said that "Staff in the Governor's Office may undertake additional work to ensure that covered domains across state agencies comply with the bill and rules adopted by the Department of Law."

One more line in the statute is hard to square with the cover page. For the right to correct inaccurate data, SB 26-189 switches off a Colorado Privacy Act exemption for data held by "the state, the judicial department of the state, or a county, city and county, or municipality." Why would a law that reaches no government switch off an exemption written for government data? The cover page doesn't say.

Is the Department simply reading the words right?

Quite possibly, and its case deserves a fair hearing.

The text leans its way. Even EPIC, a privacy and civil-liberties group, described the law in May as requiring disclosures for decisions "made by a company using an automated decisionmaking technology." A violation of this law is a deceptive trade practice, something a person does "in the course of the person's business, vocation, or occupation." When Colorado's legislature wants governments inside "person," it says so: in another article of the same title, "person" includes "government or governmental subdivision, agency, or instrumentality." And when Colorado wanted to regulate government AI, it did so by name; its 2022 facial-recognition law was aimed at "an agency of the state government or of a local government."

The structure leans its way, too. By statute the Attorney General is "the legal counsel and advisor" of every department and agency of state government — so enforcing this law against the state's Medicaid agency would mean pursuing his own client. (Counties aren't state agencies, but the awkwardness is real.)

And benefits applicants already have rights that ordinary consumers lack. A Medicaid notice of adverse action must give "A clear statement of the specific reasons supporting the intended action," and members of Health First Colorado (the state's Medicaid program) have "60 days from the date on your Notice of Action" to ask for a hearing. The fiscal note adds that most state eligibility systems follow rules "programmed by humans into a defined algorithm, rather than using generative AI or similar methods," so many of them may not be covered technology at all.

So far so good. What none of those rights does is tell you whether software shaped the decision, or how. That is the gap SB 26-189 fills (with a plain-language account of "the role the covered ADMT played"), and the cover page takes that account off the table for the agencies that decide benefits, on the strength of a definition the governor's office spent a budget cycle preparing those same agencies to meet.

The Netherlands started from the opposite premise

What happens when a country treats the government as the decider most in need of watching?

The Netherlands got there the hard way. In July 2020 the Dutch Data Protection Authority found that the tax administration's benefits office had "used applicants' nationality (Dutch/not Dutch) as an indicator in a system that automatically designated certain applications as risky," a practice it called "unlawful and discriminatory." Parliament's inquiry into the childcare allowance, Ongekend onrecht ("unprecedented injustice"), concluded, in its published English translation, that "for years, parents never had a chance." (Risk profiles that included nationality were outside its remit; that finding was the regulator's. The inquiry spread its own blame across the administration, the legislature and the courts.) Amnesty International reported that the official reviewing a flagged case "was given no information as to why the system had generated a higher-risk score." In January 2021 the whole government resigned over the scandal.

Then the regulator fined the government. In December 2021 it announced a €2.75 million fine on the tax administration (formally, on the Minister of Finance), and its chair, Aleid Wolfsen, explained why the state gets no pass: "Members of the public don't have a choice; they are forced to allow the government to process their personal data." That is the case for writing governments into a benefits law, in one sentence. You can shop around for a lender. You can't shop around for a Medicaid office.

Afterward the Dutch built a public register in which government bodies describe the algorithms they use. It launched in 2022, says it focuses on impactful algorithms, high-risk AI included, and lists 1,590 algorithms in all as of October 13, 2026, among them an algorithm the benefits agency uses to track the parents harmed in the scandal. (HAIA looked at that register once before, from a renter's side.)

Now the fair counterpoint. The register calls itself not yet complete, and in September 2025 the state secretary in charge judged a legal duty to register "(nog) niet als opportuun" or, in English, not (yet) opportune. In March 2026, with four of its nine indicators now red, the regulator named the registration of government algorithms among its concerns, and Wolfsen said that "the follow-up is lagging behind." The benefits agency's own entry marks its impact-assessment field "Veld niet ingevuld" (field not filled in). Researchers studying early city registers warned in 2021 that such registers can become "ethics theater." And repair is slow: more than 44,000 people have been recognized as harmed in the government's recovery operation, and the cabinet still aims to have every harmed parent fully compensated by the end of 2027.

So the Dutch answer is unfinished — uneven, voluntary, still argued over. But it starts from the premise that the state is the actor to watch when it decides your benefits. Colorado's statute names those decisions, and its enforcer's cover page reads the deciders out.

The first renewal letters of 2027

What follows is my extrapolation from the documents, not a forecast about any county or contractor.

January 1, 2027, is a big day for two unrelated laws. SB 26-189 starts reaching decisions made from that day on. And under a federal law requiring Medicaid redeterminations "once every 6 months" for certain adults, Colorado says some adults 19 to 64 "will need to renew every 6 months" starting that day. Renewals begin with an automated check of data the state already holds; "If enough information is not available to show that a member is exempt, a letter will be sent."

So picture next spring. A renewal check can't confirm your exemption from the new federal work requirements, the letter asking you to show it goes unanswered, a county worker reviews the flagged file, and a notice ends your coverage. It gives reasons and 60 days to appeal. What it needn't tell you, on the cover page's reading, is whether software narrowed your file. Ask the county which system was used, and it can say this law doesn't reach it. Ask the contractor that runs the platform, and it can say its duties run to a deployer — and there isn't one.

Now picture someone down your street whose help with utility bills is cut that same week by a private program using a scoring tool. That is the interim draft's own example of a covered decision (reducing a "subsidy to make energy and utilities payments"), and under the draft your neighbor is owed a disclosure, effective date included. Same kind of cut — two answers about who has to explain it.

The rare point where left and right agree

Colorado has served as a cautionary tale before. In 2008 the legal scholar Danielle Keats Citron wrote that the state's eligibility system had issued "hundreds of thousands of incorrect Medicaid, food stamp, and welfare eligibility determinations and benefit calculations since its launch in September 2004," and that "Automated systems jeopardize due process norms." (That was the record in 2008.)

On the free-market side, R Street's Adam Thierer and the American Consumer Institute's Logan Kolas put Colorado's 2024 act on their "AI Terrible Ten" list of the worst state AI policies, yet the ALEC model legislation their paper holds up as a good starting point would "conduct an inventory of AI technology use by state agencies." Amnesty, from the other direction, asks governments to "Establish effective monitoring and oversight mechanisms for algorithmic systems in the public sector." They disagree about nearly everything a business should owe you; on this they line up — the state should at least be able to say what software it runs.

What does this mean for you?

• If you live in Colorado, comment by October 26. As of October 13, 2026, the Department's comment form is open through October 26, longer if the hearing runs past that day. In your own words, ask the Department to put its answer on governments into the rule text, one way or the other; to say whether a contractor running an eligibility tool for a county is a deployer; to explain the Privacy Act carve-back; and to restore the reasons and score disclosures. The form warns that submissions "may be viewable to the public," so leave out case numbers and health details.

• Or say it out loud. The hearing is October 26 at 10 a.m., at 1300 Broadway, Room 1D, in Denver, and on Zoom if you register through the Department's rulemaking page. Anyone attending will be "invited to provide oral comments even if not registered in advance."

• If a county or the state cuts or denies your Medicaid, you're owed the specific reasons and 60 days from the notice's date to ask for an informal meeting and a state fair hearing, whatever the AI law means. In the appeal, ask whether automated tools were used.

• Ask for documents, not explanations. Colorado's open-records law makes public records "open for inspection by any person at reasonable times," with exceptions. Ask your county human services department or the state for contracts, user guides or policies on automated eligibility tools.

• If you're a Medicaid adult aged 19 to 64 with income at or below 133% of the poverty line, you may be among those renewing every six months from January 1, 2027. Answer every letter fast.

• Outside Colorado, read your state's AI bill for the word that names who owes you anything ("person," "deployer," "covered entity"), and ask whether a county could fit inside it.

The lesson, as I see it

A law is, in the end, a list of who has to answer to you. Colorado wrote benefit eligibility and renewals into its AI law, and its enforcer now reads that law as not reaching the only bodies federal rules allow to decide Medicaid and food assistance. The reading may be right on the text. It still leaves a covered domain whose main deciders sit outside the law, and it rests on a cover page to rules the Department itself calls not final.

What should you watch? October 26, for the comments and the hearing. The final rules, due on or before January 1, 2027, and whether they say one word about governments. The federal case: xAI, which sued over the 2024 law, alleges it amounts to "content- and viewpoint-based speech compulsion"; the Justice Department, which intervened, alleges the law "violates the Equal Protection Clause of the Fourteenth Amendment"; and the Attorney General said in a joint motion that he "does not intend to enforce" the law or its replacement until rulemaking ends. Under the resulting order, xAI must seek an injunction "within 28 days after final adoption" of the rules, and as of the docket's latest entry, on October 2, none had been filed. Then January 1, when the law and the six-month renewals start together.

My vote? Put the answer where someone can be held to it. If governments are out, let the legislature say so in the statute, in public. If they're in, let the final rule say that. And if "encourage" is to mean anything, start where even the free-market model bill starts, with an inventory of the automated tools Colorado's benefit decisions run through, and publish it. The Dutch built their register after a cabinet resigned. Colorado can build one before it needs to.

In Colorado's consumer-protection law, a trust is a person. Until October 26, you can still ask the state what your county is.

The first is dated April 21, 2026. The day before, 11 of the 14 members of Utah's Medical Licensing Board had asked that a prescription-renewal pilot run by a company called Doctronic, which they said they learned of only after launch, be "immediately suspended pending further discussion." Mark Steinagel, director of the Division of Professional Licensing (DOPL), and Zach Boyd, director of the Office of Artificial Intelligence Policy, declined, and assured the board: "The AI system is strictly prohibited from handling controlled substances, modifying treatment plans, or initiating new prescriptions."

The second, signed by Boyd on September 21 and Steinagel on September 22, lets an app from Nolla Health "issue orders for first-time topical acne prescriptions and renewals" to Utah adults. "All prescriptions issued under the pilot," it adds, "will be transmitted under the NPI of the overseeing physician." (An NPI, or National Provider Identifier, is the ID number that identifies a prescriber.)

To be fair to April, that sentence described Doctronic's renewal pilot, and it is still true of Doctronic; it was never a statewide rule. But it was the answer the board got when it asked the state to stop, and five months later the same two offices signed off on one of the three things it ruled out. In short: if you're an adult in Utah with mild to moderate acne, an app can now start your first prescription, with two physicians checking each one before it goes out — for now.

So what exactly did Utah sign?

Utah's AI office runs a regulatory sandbox, which, in Boyd's words as quoted by KSL, lets a company "run a business model that is kind of different from the normal regulations for a little while" so the state can judge the results. As of October 13, 2026, the public record of those agreements lists Nolla's and Doctronic's pilots as active; Legion Health's, August AI's and Expect Fitness's as approved but not yet started; master agreements with University of Utah Health and Intermountain Health, with no pilot approved; and expired ones with Dentacor and ElizaChat.

What does Nolla's agreement relax? DOPL agreed to "forgo any enforcement action," for this function only, under the laws against practicing a licensed profession while "not licensed to do so" and the unlawful- and unprofessional-conduct sections of the medical, osteopathic and pharmacy acts, a protection that extends to the physicians who rely on the system. Utah's telehealth law bars prescribing "based solely on" an online questionnaire; the app is "deemed not in violation" if it follows the agreement's protocols. And the requirement that a telehealth provider hold an active license "shall not apply" to it.

Most of this is standard sandbox machinery. Doctronic's 2025 agreement carries the same two telehealth carve-outs. August AI's refill agreement, signed in early October, puts the NPI of an "accountable prescriber of record" on each refill, and the office's Doctronic page says "there is always a physician's name attached to a prescription authorization." A doctor's number is standard across Utah's AI prescription pilots — what is new is the first prescription.

How does the software choose? Per the company's proposal, which the agreement adopts, a vision model grades your acne from photos of your face, and "a large language model (LLM) inference layer" picks a formula "from the approved formulary." The company stresses that the prescription flow has "no free-text interface" (a language model choosing from a fixed menu, in other words).

What keeps a human in the loop? Stages. In Stage 1 (at least four weeks and 100 patients), "each prescription during Stage 1 is reviewed by two independent Utah-licensed physicians" before it is sent. In Stage 2 (at least eight weeks; "Minimum patients: 500 (cumulative)"), the "AI submits directly" and a physician reviews every case afterward, at least weekly. Stage 3 ("Minimum patients: 750 (cumulative)") moves to a monthly review of "a minimum of 10% of enrollment volume," plus every escalation and adverse event. Each step needs the office's "prior written approval," and the yardstick is spelled out: "Physician agreement with AI recommendations is the primary safety metric for the pilot."

Even the state describes the pilot two ways. Its October 5 announcement spoke of "AI-assisted visual evaluations and treatment pathways for mild-to-moderate acne, under specialist oversight"; the agreement covers technology "that autonomously issues orders for first-time topical acne prescriptions." The first is where the pilot starts, the second where it is built to go. Nolla's chief executive, Luis Wenus, was plainer: "Our AI can now make that prescribing decision itself," he said, according to the Daily Caller. (In Stage 1, two physicians still approve each one first.) The agreement calls itself "a grant of regulatory mitigation only," not an endorsement.

Isn't acne the safest place to start?

It may be, and the case deserves a hearing. The pilot is limited to adults with mild to moderate acne and to "a short list of creams and gels set out in the agreement." "It does not prescribe oral medication or isotretinoin, and it does not treat severe acne," the state says, and pregnancy, breastfeeding or a weakened immune system stops the process. Boyd calls acne "comparatively low risk."

The process changed after April, too. According to Bloomberg, as Quartz reported, Boyd said the state had carved out a "narrow exception" for Nolla, which he said was the first company to engage with the Utah Medical Licensing Board before receiving authorization; KSL reported him saying board members were included in the process to develop the pilot program. The board now has a working group with the AI office, and one of April's signers — William Hamilton, M.D. — sits on it. "Utah can lead the world in safety and in implementing this amazing technology," he said, according to Fierce Healthcare.

The state's evidence standards, by Boyd and Alice Schwarze, supply the analogy behind staged review: new doctors "enter the workforce as residents before having demonstrated real-world clinical competency" and "gradually gain more autonomy." The office has added outside evaluators, though its page says, "The company being evaluated pays the evaluator directly" (evaluators must certify their independence and report safety concerns). And the company argues that doctors still initiate these prescriptions "primarily due to regulatory constraints rather than clinical complexity."

So far so good. Then why does the April letter matter?

What was April's sentence worth?

It was accurate, and it still is. As of October 13, 2026, Doctronic remains in Phase 1, where a licensed practitioner authorizes every request, and the office's FAQ for its renewal pilots still says, "During these pilots, an AI tool will never prescribe new medications." True, of those pilots.

But the board asked the state to stop a program and was answered with the terms of one contract. The next contract, built from the same template, had different terms. Is that a bait and switch? I don't think the record supports the charge — nothing in April bound September.

It was predicted, too. In January, explaining why the American Medical Association objected to the refill pilot, Robert Wachter, chair of medicine at UCSF, wrote that "once AI is allowed to prescribe a refill for an existing prescription, it's only a matter of time before the bar is lowered to allow for certain new prescriptions as well." The same month, the state's announcement quoted Sen. Kirk Cullimore, whose bill created the AI office, saying the Doctronic deal "reinforces the principle of 'doctor, not device,' ensuring automation supports, rather than replaces, human judgment." He was talking about refills. By September, the bar had been lowered.

China bet big on medical AI and wrote the opposite rule

What does it look like when a country deploying medical AI at scale answers the question the other way?

China had 3,756 internet hospitals at its health commission's September 2025 count, and they handled 130 million visits in 2024. By October 2025, Xinhua reported, its regulator had approved more than 110 deep-learning software products as highest-risk (Class III) medical devices, and a 2025 national plan targets AI-assisted primary care with basically full coverage by 2030.

Yet China's 2022 rules for online medical care, issued on a trial basis by the National Health Commission and still in force, start from the opposite premise. Article 21 reads "处方应由接诊医师本人开具，严禁使用人工智能等自动生成处方" — in translation, the attending physician personally issues the prescription, and using AI or similar means to generate prescriptions automatically is strictly prohibited. Article 13 says AI software may not stand in for the physician, and the rules encourage provinces to use AI to supervise online care: AI to watch the doctors, not replace them.

The rule has been repeated, not relaxed. Hunan's medical-insurance regulator repeated the ban in 2025 and tied it to insurance payment, even as, China Daily reported, "In clinical practice, DeepSeek is being used for decision support." Tianjin requires an online prescription to carry the physician's electronic signature and a pharmacist's approval before it takes effect. In May 2026, the national drug regulator told online platforms to identify and intercept AI prescriptions. Global Times reported the view of Zhuang Yiqiang, a former secretary of the Chinese Hospital Association, that an AI doctor is, in the paper's words, "first and foremost a machine, not a human being, so it is impossible for it to have the right to prescribe."

Now the fair counterpoint. China restrains AI prescribing, not AI; its plan even wants AI reviewing doctors' prescriptions. The rule is partly about fraud: Hunan's notice complains of fake prescriptions and drugs handed out before any prescription. It is stricter than many Americans might want: under Article 18, if a doctor judges a visit to be a first visit, the online consultation must stop, even when the doctor is human. And enforcement is imperfect. In 2025 a researcher told Science and Technology Daily, in a report People's Daily republished, that online care is harder to supervise, and the 2026 order to intercept AI prescriptions suggests, by my reading, that some still circulate.

So a doctor's name means different things. In China, it belongs to the doctor who issued the prescription. In Utah's design — by the last stage — it belongs to the physician overseeing the software.

Now picture the last stage

What follows is my extrapolation from the documents, not a forecast about Nolla or anyone else.

Say it is the summer of 2027 and the office has approved every stage (it may approve none). You scan your face, and a cream is ordered under the NPI of a physician whose network samples at least 10 percent of each month's cases, after the fact. In a month of a thousand patients, that could mean as few as a hundred reviews, plus escalations. All thousand prescriptions carry a doctor's number.

Then the list grows. Nolla's chief medical adviser, Zaid Fadul, said the service could one day reach patients "from 13 [years old] and up" if "the data proves out," according to KSL, and he told Inc., as SiliconANGLE reported, that the flu and uncomplicated urinary tract infections "are worth exploring." Each would need new terms, since this agreement covers acne only, but terms can last: the statute allows up to two extensions.

And the model travels. "Once we've proven it in Utah, then we can prove it everywhere," said Nirav Shah of Stanford's Clinical Excellence Research Center, one of the state's evaluators, which are paid by the companies they check. A bill in Congress, H.R. 238 from Rep. David Schweikert (R-AZ), would let AI count as a prescribing practitioner if "authorized pursuant to a statute of the State involved" and approved or cleared by the FDA; as of October 13, 2026, it has not moved since its referral to committee in January 2025. (Whether a sandbox agreement would even count is an open question.) Picture an AI prescriber proven in the friendliest sandbox and then offered everywhere.

Alarmed, hopeful and somewhere in between

Who's worried? Mostly doctors, and mostly about the refill pilot, since Nolla's agreement is weeks old. "We were essentially told: 'Yes this is going on. And no, you don't have a say in it,'" the board's chair, Alan Smith, said, according to the Associated Press; he was speaking only for himself. The AMA's chief executive, John Whyte, said in January that medicine is "about judgment, context, and accountability." Public Citizen, which backed the board's call to suspend Doctronic, was blunter: "No software application holds a medical license." Eric Bressman, a Penn physician-researcher, warned of a playbook in which companies "deploy first while promising to study performance later." Doctronic says it is "participating in the process as designed, with defined safeguards, physician oversight of every prescription in the first phase of the program, and continued physician involvement throughout."

In between, Stanford's Michelle Mello wrote that the refill pilot "deserves thoughtful analysis—not dismissal out of hand." Wachter wrote, "Personally, I'd have no problem using this system to refill my Lipitor," but warned that "you can bet that the doctor will be the one being sued." Remember that when a doctor's number is on the order.

On the hopeful side, Hodan Omaar of the Center for Data Innovation argued that broad restrictions "block good AI too," and Samuel Hammond and Blaine Dillingham of the Foundation for American Innovation, a Washington tech-policy think tank, praised the sandbox for "side-stepping incumbent interest groups who can more easily lobby against reforms on a case-by-case basis," while flagging "risks of preferential treatment."

Put the watchdog and the think tank side by side and they describe the same mechanism (Public Citizen says the AI office "is not a medical licensing authority"; FAI praises a design that routes around incumbents), and they disagree only on whether that is the point or the problem.

What does this mean for you?

• If the app is offered to you in Utah, read the disclosure. It must tell you that you're "interacting with generative artificial intelligence" in a temporary pilot under an agreement with the AI office, and you must acknowledge that before the AI does anything.

• Ask for a human. You can message a licensed physician at any hour (the proposal puts typical replies within 24 hours) and request a free case review at any point.

• Know the real price. It's $4.99 a month during the pilot; the compounded option is $49.99, or you can fill a generic at your own pharmacy, which the company says typically runs $10 to $40 at retail.

• Ask your pharmacist. The pharmacy is told "the prescription was generated by artificial intelligence technology" and given physicians to call.

• Read the terms you accept in the app. The agreement says pilot terms "shall not disclaim, limit, restrict, or exclude" the company's liability for physical, medical or legal harm from the outputs of the AI the agreement authorizes. Its public website terms, last updated July 26, 2025, cap its liability at $500; the in-app pilot terms aren't public, so check what you're shown. (In May, the office proposed striking a Doctronic clause saying the company "cannot be held liable for medical malpractice.")

• Complain to the right office. Pilot concerns: email ai@utah.gov and "name the pilot." A clinician's conduct: the Division of Professional Licensing, the same division that agreed not to enforce certain rules here. Misleading claims: the Division of Consumer Protection; as the AI office's page puts it, "An agreement with this office is no defense to a consumer protection violation." You needn't live in Utah to write to the AI office.

• Watch the reports. Nolla's first monthly report is due November 15, 2026, but the office treats such reports as protected records where the law allows; only the quarterly reports, the first around January 15, 2027, are promised to be "available to the public."

The lesson, as I see it

A reassurance is only as wide as the document it sits in. April's sentence was true about one pilot, it was given to a board that wanted that pilot stopped, and it said nothing about the next agreement. Every prescription under the new one carries a doctor's number — at Stage 1, two doctors read each one; at Stage 3, a doctor may never see yours.

What should you watch? Doctronic's term ends October 24, 2026; as of October 13, no extension had been posted. The office must report annually, before November 30, to a legislative committee. Any move to Stage 2 needs the office's written approval, so watch whether it is announced, and on what numbers. And watch Pennsylvania, whose State Board of Medicine sued Character.AI in May over what it alleges is "the unlawful practice of medicine and surgery" (the company's disclaimers say its characters "should be treated as fiction"); as of October 13, 2026, there is no ruling. Utah's board, the state's April reply noted, "serves in an advisory capacity."

My vote? Let the evidence decide how far the software goes, and decide it in the open: publish the monthly numbers on how often doctors agree with the AI instead of filing them as protected records, and give the board's working group a formal say before review drops from every case to a sample. If a doctor's number is going to stand for a decision software made, that deserves a debate in the Legislature, not just a scope line in a contract. If the numbers hold up, Utah will have something rare: evidence. If they stay in a drawer, it will have a precedent instead.

The HAIA Foundation exists to help the public understand the AI being written into their lives, one contract at a time. If you'd like to read the next one with us before the next stage is signed, subscribe.

On October 7, 2026, OpenAI's lawyers asked a federal judge in Tallahassee to dismiss two of the six consolidated lawsuits over the April 17, 2025 shooting at Florida State University (docket entry 42). The two plaintiffs, both wounded that day, argue, as the motion describes their claim, that by investing in safety systems OpenAI "assumed a duty" to protect the public from its users' crimes. The motion's answer: the theory "fails as a matter of law," because "internal policies do not create a duty to third parties." Those words come from a 2016 Florida appeals-court decision, De La Torre v. Flanigan's, which the brief quotes; the choice to use them is the lawyers'.

Read together, the two documents divide the labor. The page makes a promise; the motion argues that promises like it create no legal duty to the people they're meant to protect. Put plainly, the promise is voluntary, and OpenAI is asking a court to agree that such promises stay that way, which would mean that if one ever fails, the people hurt can't sue over the failure.

One date first, because it governs the rest: the shooting came before both documents. The "we notify" page is dated a year later, and even the company's softer 2025 wording (more on that below) came four months after the shooting. Whatever happened at FSU, OpenAI didn't break this promise there — it hadn't made it yet.

In July I wrote that the most popular therapist in America isn't a person, and summed up its credentials in one line: "No exam. No license. No board. No duty to warn. No malpractice exposure." This fall, the fourth item turned up in OpenAI's motions — as a legal argument. I'll concede up front that on Florida law it's a strong one: Florida's courts have refused a duty to warn even for psychiatrists. But Florida's Legislature didn't leave it there, and that difference is what this piece is about.

So why should a motion in Tallahassee matter to you? Think of the last thing you typed into a chatbot that you'd rather nobody read aloud. Who might read it? And if someone at the company sees danger to another person in it, what do they owe that person? The page answers the first question. The motion's answer to the second, under Florida law, is nothing a court can enforce.

What OpenAI says happens to a flagged chat

What does the company say happens, step by step? By the page's account, "automated detection systems" look for "potentially concerning activity at scale"; a flagged account or conversation "is assessed in context by trained personnel" (people, in other words, not only software); cases showing signs of "potentially serious, real-world harm" get "a more in-depth investigation" using "structured criteria," a stage "reserved for a limited subset of cases"; and most enforcement, "including bans for violence," happens "directly between OpenAI and the user."

Two details matter for the lawsuits. Some risks, the page says, only show up as "a broader pattern within a long conversation—or across conversations." And the work is "guided by input from psychologists, psychiatrists, civil liberties and law enforcement experts." (Keep the first two professions in mind. Their expertise is on the page. Their legal duties, as you'll see, are not.)

The wording wasn't always this firm. In a post dated August 26, 2025, OpenAI said that if human reviewers determine "a case involves an imminent threat of serious physical harm to others, we may refer it to law enforcement."

So what happened between "may refer" and "we notify"? Among other things, Tumbler Ridge. Before a mass shooting at a secondary school in that British Columbia town, OpenAI had reviewed the shooter's ChatGPT account; its own court filing, as CBC quoted it, refers to "the decision at that time not to refer" it to Canadian police. In February 2026, OpenAI's Ann O'Leary wrote that under an "enhanced law enforcement referral protocol," the company would refer "the account banned in June 2025" to police "if it were discovered today." In a letter dated April 23, Sam Altman wrote that he was "deeply sorry that we did not alert law enforcement" to the account. The community-safety page is dated five days later.

(When police come asking instead, OpenAI's request policy requires "a valid warrant or equivalent" for user content, barring emergencies; that's one of the two doors I wrote about in August. This piece is about the company calling first.)

How does OpenAI compare with its competitors? Document to document, all five publish rules for police requests and emergencies. Google's page says that to prevent a death or serious physical harm, "we may provide information to a government agency." Meta's general law-enforcement page, last updated in 2022 and written for all its services, says it "may provide information to law enforcement that will help them respond to emergencies." xAI, the maker of Grok (its policies now call the company SpaceXAI LLC, or "SpaceXSI"), allows disclosure "to protect the personal safety of SpaceXSI, its customers, or any person." Anthropic's privacy policy allows disclosure to "prevent serious harm to any person or to property," and its consumer terms reserve the right, "at our sole discretion, to report information from or about you" to law enforcement. (A disclosure: this piece was drafted with help from Anthropic's Claude.)

Of the five, only OpenAI publishes a page saying, in so many words, that it notifies police when conversations indicate an imminent and credible risk. Searches for this piece found no equivalent from the other four (which doesn't mean none exists), and silence proves nothing about practice. (Practice is a separate question, and it comes up below.)

What OpenAI's lawyers told the court

The shooting at Florida State "killed two people and wounded several others," OpenAI's motion says. The two men killed were Tiru Chabba and Robert Morales, the university's dining director. The man accused of the shooting, Phoenix Ikner, has pleaded not guilty; his trial is now scheduled for June 8, 2027, according to court records WCTV cited. No jury has decided what happened that day.

Six suits over the shooting are now consolidated in federal court in Tallahassee before Judge Mark E. Walker, "for case-management purposes and discovery only" (each keeps its own trial). The lead case was filed in May by Chabba's widow, Vandana Joshi. Her complaint alleges that OpenAI failed to build a product that would "alert a human that investigation by law enforcement may be necessary to prevent a specific plan for imminent harm to the public," and that "it did not flag and escalate the conversation for human review." Those are allegations; OpenAI disputes them.

OpenAI tells it differently. "At no point did Ikner tell ChatGPT that he was planning or intended to commit a shooting," its motions say. By OpenAI's account, when he indicated he was struggling with depression, ChatGPT "repeatedly encouraged him" to talk to "a trusted friend, a pastor, or a therapist" and "referred him to the 988 crisis line," and it refused requests about Molotov cocktails. (The chat logs sit behind the federal courts' paywall, so what's quoted here is each side's version.)

Then the law. In September, answering Joshi, OpenAI argued that "imposing on OpenAI a duty to psychoanalyze its users, detect possible criminal propensities, and report or warn about users who might be dangerous would be directly contrary to Florida law." The October motion adds the line in this piece's title, and a paradox: if a general commitment to safety could expose a company to liability for any third party's wrongdoing, companies "would—paradoxically—be discouraged from implementing safety measures in the first place."

Then the lawyers reach for the comparison this piece is built around. Florida, the motion says, recognizes "no duty to warn" about another person's violence without a special relationship, and its negligence law "does not recognize a duty of mental health providers to warn third parties that a patient may be dangerous." Hence: "If medical professionals in Florida have no tort duty to warn about potentially dangerous patients—even ones who have actually expressed violent threats—it would make even less sense to impose such a duty on a general-purpose communications service like OpenAI." A footnote concedes that "A Florida statute requires treating psychiatrists to disclose to law enforcement" certain threats, then argues it doesn't reach this case: OpenAI "is not a psychiatrist," the accused gunman wasn't its patient, and the statute "is not enforceable through a negligence claim, but only by a state licensing board or the Department of Health."

The motion also raises "serious questions about whether any aspect of ChatGPT" counts as a product at all, and warns that the suits would use liability "to force OpenAI to evaluate users' speech" and "censor their communications and report them to the government if they show too much interest in controversial viewpoints, ideas, or topics." Set that beside the safety page and the tension is plain: the company already says it evaluates conversations and reports some to police. The lawyers' point, as I read it, is who decides, and under what threat.

Where do the cases stand? As of October 13, 2026, Judge Walker had not ruled on either motion. He gave Joshi until October 13 to respond, and that day she filed her opposition, going straight at the therapist comparison. Among her lawyers' reasons it fails: "OpenAI reviews conversations." The other plaintiffs' responses are due November 4, and OpenAI may file a combined motion on three more of the cases by October 21.

Is this one company's defense? Not by the look of it. In a California suit over a suicide that the plaintiff blames on Google's Gemini chatbot (a different harm from FSU's), Google's motion argues that Gemini is not a "product" for purposes of product-liability law and that "the First Amendment independently bars" the claims. It's signed by the same firm, Wilson Sonsini, and (yes) the same lawyer, Matthew A. Macdonald, whose name is on OpenAI's October motion. The judge took it under submission on August 5 and, as of October 13, hadn't ruled. Character.AI lost a version of that argument at the pleading stage in May 2025, when a federal judge in Orlando held its app was a product for claims about defects rather than "ideas or expressions within the app"; it, its founders and Google later agreed to settle.

OpenAI's best argument, and it's a good one

Give OpenAI's position its full weight first, because much of it is right.

First, the law is largely on its side: a judge who agrees with OpenAI would be applying Florida law (the psychiatrist cases are coming), not inventing a loophole.

Second, violence is hard to predict, and a system that tries will often be wrong. Anat Lior, a Drexel law professor who favors a duty for AI firms, concedes that "the likelihood of false positives would likely be substantial."

Third, reporting has costs. Robert Diab, a law professor in British Columbia writing for the Centre for International Governance Innovation, warns that "A legal duty to report violent threats would give AI companies a strong incentive to err on the side of caution," and that users who believe anything they say could trigger a police report will change those conversations, or stop having them. Referrals already happen without any duty. In August, The Daily Wire reported that OpenAI had flagged a Palm Beach County man's threats, handing over two months' worth of his chat logs to federal agents, who passed them to the sheriff's office; he took a plea deal, with adjudication withheld. In late September a Lee County woman was arrested after her statements on an Anthropic AI platform were, investigators wrote, "escalated to a human review team, which then reported the statements to law enforcement." She faces a felony charge, not a conviction; according to the sheriff, she later said she uses AI like a "diary." Whatever you make of either case, that is what it looks like when the thing you confide in can also report you.

Fourth, the paradox is real. OpenAI's "paradoxically" has an unlikely ally: Lior warns that an overbroad duty "might create a perverse incentive for companies to avoid monitoring entirely, since a lack of knowledge could release them from duty of care obligations." When the defendant and a proponent of a duty agree on a risk, take the risk seriously; they part ways on the cure: no duty, or a carefully drawn one.

Fifth, speech — the motion's First Amendment objection has serious company among scholars, as you'll see below.

So is that the end of it? Joshi's lawyers say no, and their October 13 brief turns the comparison around: it "supports Plaintiff's position rather than OpenAI's." Boynton, the 1991 Florida decision OpenAI relies on, "makes clear mental health providers are relieved of a duty to warn in part because of the recognized near impossibility of a medical professional to predict dangerousness from clinical interactions." But "OpenAI is a system with the technological capacity to analyze patterns across thousands of queries, apply machine learning algorithms, and detect statistically significant indicators of planning for violence." Her theory "rests on OpenAI having voluntarily undertaken a duty" to flag dangerous query patterns for human review, and they cite what older cases call "hornbook tort law": "one who undertakes to warn the public of danger and thereby induces reliance must perform his 'good Samaritan' task in a careful manner."

So if the therapist is the comparison both sides want, what does the law ask of a therapist who hears a threat?

Put the same threat in a therapist's office

California: a duty to protect

The modern rule began in California, with a killing: "On October 27, 1969, Prosenjit Poddar killed Tatiana Tarasoff." On July 1, 1976, the California Supreme Court held that when a therapist determines, or should determine, "that his patient presents a serious danger of violence to another, he incurs an obligation to use reasonable care to protect the intended victim against such danger." That might mean warning the victim or choosing "to notify the police." Its best-known sentence runs nine words: "The protective privilege ends where the public peril begins."

The court heard OpenAI's prediction problem fifty years early. It recognized "the difficulty that a therapist encounters in attempting to forecast whether a patient presents a serious danger of violence," and held that "professional inaccuracy in predicting violence cannot negate the therapist's duty to protect the threatened victim." On false alarms it was blunt: "The risk that unnecessary warnings may be given is a reasonable price to pay for the lives of possible victims that may be saved." Justice Mosk, partly dissenting, warned that the majority's standard "will take us from the world of reality into the wonderland of clairvoyance."

California's Legislature later narrowed the rule into law. Civil Code section 43.92 shields a therapist from liability unless the patient "has communicated to the psychotherapist a serious threat of physical violence against a reasonably identifiable victim or victims," and the duty is discharged "by making reasonable efforts to communicate the threat to the victim or victims and to a law enforcement agency." Separately, a licensed psychotherapist "shall report to a local law enforcement agency, within 24 hours" the identity of a person who makes such a threat, which starts a five-year firearms ban.

Florida: no lawsuit, but a phone call

Florida went the other way in its courts and — later — partway back in its statutes. In 1991, asked in a case of first impression to adopt Tarasoff, Florida's Third District Court of Appeal, sitting en banc, declined: the duty "is neither reasonable nor workable and is potentially fatal to effective patient-therapist relationships," it wrote in Boynton v. Burglass, borrowing Justice Mosk's "wonderland of clairvoyance." In 2020, in litigation over the Parkland school shooting, a Florida appeals court noted that Florida courts "have continuously applied Boynton reasoning" and held that mental health providers "are not legally tasked with identifying, advising, or warning third parties when the patient has made only a general threat to harm others."

That word "general" matters, because by then the Legislature had written a rule for specific threats. Until 2019, Florida's statute said a psychiatrist "may disclose patient communications" to warn a potential victim "or to communicate the threat to a law enforcement agency," a choice either way. After Parkland, the Legislature turned that "or" into "and must." Under the 2026 Florida Statutes, when a patient communicates "a specific threat to cause serious bodily injury or death to an identified or a readily available person," and the psychiatrist judges that the patient has "the apparent intent and ability to imminently or immediately carry out such threat," the psychiatrist "may disclose patient communications to the extent necessary to warn any potential victim and must disclose patient communications to the extent necessary to communicate the threat to a law enforcement agency." The police, in turn, "must take appropriate action." Psychologists and licensed counselors "shall disclose" such threats to police, too.

Florida's bargain

That is Florida's bargain, and it is the honest complication in this story: Florida tells a psychiatrist who hears a specific, imminent threat to call the police, and it does not let the victim sue if the psychiatrist doesn't. Judge Gerber, concurring in the 2020 Parkland decision, wrote that the amendment imposed "a legal duty upon psychiatrists to disclose patient communications to a law enforcement agency" but "still did not impose a legal duty upon psychiatrists to warn any potential victim, nor imposed any liability upon psychiatrists who fail to disclose patient communications to potential victims or law enforcement." The rule is enforced through the licensing system instead, as OpenAI's own brief notes; failing to perform "any statutory or legal obligation placed upon a licensee" is grounds for discipline. On Judge Gerber's reading, OpenAI's position fits Florida law.

So what separates the therapist from the chatbot company is where the duty lives. The psychiatrist's is written in a statute and policed by a board. OpenAI's is written on its own website, and its lawyers want a court to hold that policies like it create no duty to the people they're meant to protect.

And the chatbot company?

Federal law lets an online provider share a user's messages with the government in an emergency: a provider "may divulge" them when it believes in good faith that "an emergency involving danger of death or serious physical injury to any person requires disclosure without delay." May, not must. Where Congress wanted a "must," it wrote one. For child sexual exploitation, a provider "shall, as soon as reasonably possible" report to a national tipline once it has actual knowledge, and the same section says nothing in it requires a provider to "monitor any user, subscriber, or customer." For threats of violence, as a student post on the Minnesota Journal of Law, Science & Technology's forum puts it, providers are "left to their own discretion."

Line up the three. A California therapist has a duty to protect an identifiable victim. A Florida therapist must call the police about a specific, imminent threat. A chatbot company may call — under its own policy — and federal law leaves the choice to it.

Justice Clark, dissenting in Tarasoff, said the choice between treatment and "a system of warnings" was "properly one for the Legislature." For clinicians, both states' legislatures took it up. For chatbots, Florida's AI Bill of Rights died in the House in March. In April, pressing the House to pass it in a special session, Gov. Ron DeSantis said, "We see ChatGPT, what they did with this FSU shooting." A week later that version, which would have had companion-chatbot platforms notify parents when a minor expressed an intent to harm themselves or others, died in a House subcommittee. Its notice ran to parents, not police.

A province pleads Tarasoff

On the other coast, a government is pressing the opposite answer. On September 21, British Columbia sued OpenAI in federal court in San Francisco over the Tumbler Ridge shooting, in a complaint with a section headed "OpenAI's Own Policies Establish the Duty to Warn." It pleads Tarasoff by name: "Having held itself out as voluntarily undertaking and performing exactly the protective function Tarasoff requires, OpenAI cannot disclaim the duty it publicly assumed." It alleges that OpenAI's safety team recommended notifying the RCMP and that "OpenAI's leadership overruled that recommendation and warned no one." OpenAI disputes at least part of that story: when thirty more complaints by people present at the shooting alleged on September 2 that officials including global-affairs chief Chris Lehane had overridden the safety team, Jason Kwon, OpenAI's chief strategy officer, said it is "absolutely false to say Chris Lehane was involved with our original referral decision." No court has tested any of it.

OpenAI wants the case heard in British Columbia; as of October 13, its motion was due October 15, with a hearing set for December 17, and it has asked the same court to send the victims' and families' cases there, too.

Three futures for one sentence

None of what follows has happened. Each is my extrapolation from a document that has.

The promise becomes an order. British Columbia asks the court to order OpenAI to "establish and adhere to a policy of referring to law enforcement any user whose conversations present an imminent or credible threat of serious physical harm to others, consistent with OpenAI's own stated escalation criteria." Read it closely: the page says "imminent and credible," the proposed order "imminent or credible." (One word, a much wider net.) Picture a 2028 ruling — after the fight over where the case is heard — that writes OpenAI's escalation criteria into an injunction. A sentence the company wrote for its website becomes one it can't change without asking a judge.

A tipline for threats. Imagine Congress copying its child-exploitation design: report what you know, with no duty to go looking. Pair it with the People-First Chatbot Act, a House bill from Reps. Valerie Foushee and Greg Casar that would require a warrant before the government could compel access to chat logs, and would bar companies from claiming your chats are confidential (they could not "represent that the input data or chat log of a user is confidential"). Two doors, two locks: the company must call about what it knows, and the police need a warrant for the rest. (The bill went to committee on July 9 and, as of October 13, 2026, had gone no further.)

The company that doesn't look, and the court that says it must. If a duty attaches to what a company knows, some company will decide to know less. British Columbia's premier, David Eby, has already written its slogan, as a warning: "We're the company that doesn't tell the cops if you're planning a violent attack." Now flip it. A court takes the widow's argument to its end and treats what a system can detect as what it must: if OpenAI can see "a broader pattern" across conversations, a jury asks why it didn't. Every ambiguous message typed at 2 a.m. becomes a possible report — and the Lee County "diary" problem goes national.

Which arrives first depends on whether a legislature moves before the next jury does.

Who wants a duty, and who fears one

Who's right? The people arguing about it don't sort neatly by party.

For a duty, in some form. Lior argues in Lawfare that even a limited duty "would be welcomed in the AI age, where companies' legal duties to users remain unclear," and in The Conversation she narrows it: "A narrow, carefully defined duty to warn, triggered only when an AI system flags a user's behavior and it is reviewed by humans, would be a meaningful step forward." British Columbia's attorney general, Niki Sharma, whose government is suing over OpenAI's "failure to notify law enforcement," has also proposed Criminal Code amendments "to ensure a pathway to human accountability for AI's actions." In Florida the pressure comes from Republicans: Attorney General James Uthmeier, who is pursuing a separate case over minors that I covered October 7, said that "If ChatGPT were a person," then "it would be facing charges for murder," a prosecutor's statement rather than a charge. And Jay Edelson, who represents Tumbler Ridge victims and families, says the harm came from "decisions made by people at OpenAI."

Wary of one. Beyond Diab, the Electronic Frontier Foundation, writing about police demands for chat logs rather than company referrals, says the Constitution "gives only one answer: get a warrant," and notes that OpenAI states that requirement explicitly while "others like Anthropic could stand to be more precise." Eugene Volokh, a libertarian legal scholar at Stanford's Hoover Institution, writing about an April order that temporarily kept a dangerous user's ChatGPT accounts suspended, drew the line this piece keeps circling: there "wouldn't be a First Amendment problem with OpenAI itself choosing to cut off the user's access," but the court's procedure "raises serious First Amendment concerns." Clay Calvert of the American Enterprise Institute warned, after the Character.AI ruling, that if courts conclude chatbot output isn't speech, "it will negatively affect generative AI (GenAI) tools by deterring their development." The House Democrats behind the People-First Chatbot Act want warrants for compelled access, a privacy rule rather than a reporting one.

What does this mean for you?

• Assume a person may read a flagged chat. OpenAI says flagged conversations are "assessed in context by trained personnel"; Anthropic reserves the right to report "at our sole discretion"; Google, Meta and xAI keep emergency exceptions. As Chrissann Ruehle, who teaches AI and management at Florida Gulf Coast University, told WINK News, "AI is not your best friend."

• Don't count on "temporary." OpenAI "may keep a copy of a temporary chat for up to 30 days for safety purposes," and turning off memory and personalization "does not disable safety features."

• Read your chatbot's referral language before you confide. OpenAI's threshold is "an imminent and credible risk of harm to others." Find the equivalent document for the service you use, and check whether it says "may" or something firmer.

• In a crisis, reach a person. Text, call, or chat 988, which "offers 24/7 judgment-free support for mental health, substance use, and more."

• Know what a clinician owes that a chatbot company doesn't. A Florida psychiatrist, psychologist or licensed counselor who hears a specific threat they judge imminent must tell the police; a California therapist told of a serious threat against an identifiable victim has a duty to protect that person. A chatbot company owes what its policy says and, if OpenAI's lawyers persuade the court, nothing a victim could sue over.

• Watch the dockets. As of October 13, 2026, there's no ruling in Tallahassee. The other FSU plaintiffs' responses are due November 4; British Columbia's fight over where its case belongs has a hearing on December 17.

• Tell your legislators which rule you want. As of October 13, the People-First Chatbot Act had sat in committee since July 9, and Florida's chatbot bill died twice this year. Should companies have to report specific threats? Should police need a warrant for everything else? Both? The question is open, so your view still counts.

The lesson, as I see it

It would be easy to call the page and the brief hypocrisy, and I don't think that's fair. The page is a real commitment, its wording has hardened from "may refer" to "we notify," and the lawyers are describing Florida law much as Florida's judges have. The problem is structural. A promise a company writes, the company can rewrite. A duty a legislature writes comes with a trigger, a definition and someone to answer to.

For clinicians, two very different states got there: California through a court and then a statute, Florida through a statute after its courts said no. Both made the protective privilege yield, narrowly, to a specific threat. Fifty years after Tarasoff, the chatbot you may be talking to at 2 a.m. has a web page.

My vote? A narrow statute, written before the next tragedy rather than after it: Florida's trigger (a specific threat against an identified or readily available person, judged imminent), the child-exploitation design (report what you know, no duty to go looking), a warrant for anything police want beyond that, and a decision about who may sue, made openly by legislators instead of in a footnote. Reasonable people will draw those lines elsewhere. They should draw them in a statute.

What should you watch, beyond the dockets? Florida's 2027 session, for a third chatbot bill and whether it says anything about threats. Whatever Judge Walker rules, Justice Clark's point from 1976 still stands: the hard trade-off here is "properly one for the Legislature."

A safety promise is only tested when it fails, and by then it's usually a matter for lawyers. The HAIA Foundation works to bring the public into that conversation earlier; if you'd like a seat in it, subscribe.

A testimonial wouldn't settle it, and neither would the company's own chart (you'd want a number the company didn't produce). You'd want the state's numbers — and in Texas, those are public. The Texas Education Agency's reporting system lets you look up any public school's STAAR results, STAAR being the state's annual exam. A search box invites you to "Enter full or partial campus, district, or county name," and the report sets the school's results beside its district's and the state's.

Keep that search box in mind. In May 2025, an Alpha leader told Texas education officials that after the company's two-hour learning platform came to Texas Preparatory School, an Austin charter, outcomes went from most students failing state exams to 50 to 60 percent passing. That's how ProPublica and The Texas Tribune recounted it in September. Their next sentence: "Test results published by the Texas Education Agency don't back up that claim."

Type in the school's name and you can see why. For 2024-25, the state's report for the Austin campus shows 21 percent of its tested students reaching "Approaches Grade Level or Above," the lowest level that counts as passing, against 75 percent statewide. The year before, the campus had been at 19 percent, and the share at "Meets Grade Level or Above" (students the test showed at grade level, as the newsrooms put it) fell from 10 percent to zero.

What the state's education agency did next is the rest of the story. Over the following year, the newsrooms reported on October 1, the agency traded emails with companies connected to Alpha, helped with a one-page explainer for school districts and connected them with district leaders. At least three districts (Houston, Fort Davis and Aldine) launched pilots of Alpha's AI tool. The agency says "there is no formal partnership between TEA and Alpha Schools." Gov. Greg Abbott's office says any tool a district deploys must "prove results for students."

So what proof did the state ask for? And what should you ask for, before a district near you says yes?

What the state's report shows, and what it can't

Is 21 percent the whole picture? No — and the rest of it cuts both ways.

Start with the levels. Texas reports three: "Approaches Grade Level or Above," "Meets Grade Level or Above" and "Masters Grade Level." At the Austin campus in 2024-25 they were 21, 0 and 0 percent, against 75, 50 and 21 percent statewide; in reading, 32 percent reached Approaches, and in math, 16 percent. (If someone quotes you a pass rate without naming the level, ask which one.)

The slide began before Alpha arrived, and it's only fair to say so. In 2022-23, 48 percent of the campus's tested students reached Approaches; by 2023-24 the campus had already fallen to 19 percent. ProPublica and the Tribune report that the charter was "already facing a potential state-imposed closure because of low student test scores and failed financial audits."

For 2025, the campus drew an F from the state, and the charter as a whole received its third consecutive F, for 2023, 2024 and 2025, "largely based on the test scores it received during the partnership with Alpha," in the newsrooms' words. The state, they reported, had decided in the middle of the partnership to close the charter for good, letting the campus finish the school year.

How many children is that? The campus enrolled 59 students, and its tested grades, 3 through 6, held about two dozen children. At that size one child moves a percentage by about four points, so any single year is noisy. Noise doesn't rewrite what the report recorded, though. And because the state's STAAR reports count only students enrolled at the same campus on both the fall snapshot date and testing day, the 21 percent isn't dragged down by late arrivals.

Which students, which campus and which year did the May 2025 claim describe? The reporting doesn't say, and Alpha's leaders didn't answer most of the newsrooms' questions, "including about their test scores." The charter's other campus was at 57 percent in 2023-24, down from 70; neither campus shows a climb from mostly failing to 50 or 60 percent in TEA's numbers. "I don't see the extreme growth," said Toni Templeton, a University of Houston research scientist who reviewed the records for the newsrooms. "If you're such a high-performing school, you should have no problem demonstrating it."

How a vetoed charter became three pilots

How does a company whose charter the state board turned down end up in public-school classrooms anyway? By another door.

On June 25, 2025, the State Board of Education — sitting as a committee of the full board — voted 10 to 3 to recommend vetoing a charter called Valenta Academy, in Bastrop, which was to be built on the two-hour learning model; two days later, TEA announced that the board had "vetoed the granting of a charter." ProPublica and the Tribune describe that summer's 10-to-3 vote against Alpha leaders' bid, which Commissioner Mike Morath had supported, and say board members cited AI teaching, screen time and "lingering questions about the drastic student test improvements Alpha leaders presented." It was a "largely conservative" board that "had approved most charter applications over the last decade."

Morath "has been a supporter of Alpha's model before and after the vote, which he doesn't have the power to override," the newsrooms wrote. From September 2025, records they obtained show, he and his staff exchanged "a flurry of emails" with leaders of companies connected to Alpha and visited their campuses several times. Morath offered to personally introduce an Alpha leader to Mike Miles, the superintendent he had appointed to run the state's takeover of Houston's schools, and a TEA associate commissioner wrote of "piloting a few supplemental ... instances in the state." Morath's own line on the company: "There are lessons to be learned in a school like Alpha."

The emails show that "state education officials and Alpha affiliates approached at least 10 school districts about the AI program." At least three launched pilots, and at least five didn't pursue it. Leaders in Aldine and Fort Davis told the reporters it wasn't unusual for the state agency to suggest possible partnerships, and said they were excited about the pilot.

TEA's account is brief. Its written statement says there is no formal partnership, that the agency "is always interested in promising ways to improve student outcomes in math and reading," and (in the newsrooms' summary) that its officials connected district leaders who were interested and left the decision to them. Yet, the reporters note, "Morath's agency knew about results in at least one of those charters, Texas Preparatory School in Austin." And as of their October 1 story, TEA "has not responded to questions about its efforts for months, initially failed to provide some of Morath's emails in response to public information requests and continues fighting the release of additional communications."

What the three pilots are (and aren't)

What did those districts sign up for? Not Alpha's full model — all three say they will use the software for supplemental learning.

• Fort Davis is giving it to K-8 students who need more help in reading and math. Michelle Hartmann, the deputy superintendent, called it "an opportunity to provide an extra layer of intervention" and later told the reporters that students were very engaged.

• Aldine is using it with roughly 300 students at four middle schools who need support in math.

• Houston is running it at Gregg and Clemente Martinez elementary schools, only for students who score above 60% in reading and math assessments. The district says it comes at no cost to HISD and that "Houston ISD teachers will remain the teachers of record, and the pilot does not replace classroom teachers." (The $4.5 million in Houston's budget is for its nine "Future 2" schools, a district model that, like Alpha's, spends fewer hours on core academics; two of the nine run the pilot, and Houston says it isn't paying Alpha.)

Houston says it "will monitor student outcomes throughout the school year and use those results to inform future decisions." It also asked the Texas attorney general to withhold its contract from the newsrooms. As of October 13, 2026, the outcome of that request is unknown.

Think about what Houston's design does to the evidence. If every child in a pilot already scores above 60 percent, a rising line next spring will be hard to read — how much is the software, and how much is who was chosen? And engagement, which Fort Davis reports, is good news but not a result. (HAIA has covered a study in seven English schools where the students who learned the least liked it the most.)

Alpha's private schools came in through a third door. SB 2, the 2025 law that created Texas's education savings account (voucher) program, approves private schools that show accreditation, two years of operation and an annual test, which may be "a nationally norm-referenced assessment instrument" rather than the state's exam; the comptroller, adopting its rules, wrote that the law "does not require private schools to administer the same assessments as public schools." Alpha now runs "more than 30 virtual and in-person campuses" in Texas, most accepted into the program, the newsrooms found. So one company can be measured on the state's test in one school and on a national test of its choosing in another.

The one state that said yes

Is a failing school with two dozen tested children a fair test? Arizona offers another, on terms Alpha's co-founder welcomed.

In January 2025, while an Alpha-linked charter was seeking approval in Pennsylvania, co-founder MacKenzie Price told Chalkbeat, "The great news about public charters is we've got to report our results." Then: "So the proof is going to be in the pudding."

Arizona is where that pudding is now being served. On December 16, 2024, the state's Board for Charter Schools approved Unbound Academy by a single vote, 4 to 3, as an online charter for grades 4 through 8 built on the two-hour model. Its own application predicted that in Year 1, 65 percent of its students would be proficient in reading and 60 percent in math, against baselines of 40 and 34 percent for the students it expected to serve.

Arizona posted its official results on October 6, 2026. In the state's file, 9 percent of Unbound's 180 math test-takers passed, with 77 percent at the lowest of four levels, and 28 percent of its 171 English language arts test-takers passed. (The newsrooms, working from preliminary scores presented to the school's oversight board, had reported 10 percent in math; the official figure is 9.) Statewide, pass rates in grades 4 through 8 ranged from 38 to 47 percent in English and 27 to 40 percent in math. Unbound came in below every one of them.

Is that the end of it? Not quite — the same file holds the best evidence in Unbound's favor. The school kept enrolling students into the spring (its board slides count 41 new starts in January 2026 alone), and about two-thirds of its English test-takers weren't enrolled for the full academic year. Among the 59 who were, 39 percent passed English; among the 112 who weren't, 22 percent. (The file masks the full-year math figure.) Thirty-nine percent is still far from 65, but it tells a different story than the average, and the Austin numbers had already left out late arrivals.

As of October 13, 2026, a week after Arizona posted its file, Unbound's own website still said that state results "will be published as they become available." (Websites lag. That's worth knowing, and not worth more than that.) The same page advertises "2.8×" "faster learning vs. national average (NWEA MAP Growth)," measured "across the 2-Hour Learning model," meaning Alpha's whole network; Unbound's own board slides reported "MAP - 1.8x average growth." And Scientific American reported in August that "Alpha School has not released the underlying data behind its claims."

Don't expect a letter grade to settle it this fall, either. Under the state's grading rules, a new school "will not receive an A-F letter grade" in its first year, so Unbound's first grade can come next fall at the earliest.

Is any of this fair to Alpha?

Fair to ask. The strongest case for patience runs roughly like this.

First, the public schools Alpha has been judged by are hard cases: Texas Prep was failing before the partnership year, and Unbound was a first-year online school still filling seats in March. Neither resembles the private campuses where, as state officials reviewing Alpha's charter bids most often worried, the model had been tested "only among affluent students" and scholarship recipients. Early public results may be measuring the hardest version of the experiment. Kelsey Piper, an education writer who is no fan of Alpha's marketing, writes that Unbound's "student body seems to have arrived at Alpha performing well below average to begin with."

Second, the Texas pilots aren't the full model, and the model isn't teacherless. At Unbound, AZFamily reported, "all staff hold Arizona teaching certificates," and the school's site says "Certified teachers are live on screen all morning." Alpha's leaders, who declined interviews, "maintained that teachers' roles remain significant despite lessons delivered by the AI platform."

Third, the idea underneath isn't fringe. A 2025 review of 28 studies in npj Science of Learning found the effects of intelligent tutoring systems on K-12 students "generally positive," though "mitigated when compared to non-intelligent tutoring systems." Harvard's Kelly Miller, who calls Alpha's approach "better than what currently exists in K–12," still wants "more rigorous analysis" of what makes it work. Tom K. Lindsay of the Texas Public Policy Foundation, a conservative think tank, calls Alpha's results "reported and debated" but argues that with mastery pacing, "outcomes can move." Piper allows that "Alpha seems to have made some real achievements, if not the miraculous numbers they claim." And Alpha's Carl Hendrick makes the scaling argument in five words: "You can't scale good teaching."

Fourth, outside researchers are now looking. Alpha's spokesperson says Harvard's Human Flourishing Lab and MIT's Blueprint Labs "have both begun independent research studying Alpha's educational model." (MIT's lab says its work "is supported by a gift from Alpha School," with funders' role "contractually limited to providing financial support." No timeframe for results has been given.)

So far, so good? Up to a point. None of it answers the first question a parent would ask: what do the state's own tests show, for how many children, against what was predicted? Alpha's headline claim, that its students "grow 2.6 times faster than peers on nationally normed MAP tests," rests on a test schools administer and report themselves; NWEA, which makes MAP, says "we don't validate or verify school data." Andrew McEachin, an Educational Testing Service researcher who helped develop MAP, warns that strong results may reflect "who's attending the school, not the experience of the kid attending." The growth numbers can't be checked from outside. The numbers that can be checked haven't matched the predictions.

Pennsylvania put its reasons in writing

What does it look like when a state asks for that evidence before saying yes? Pennsylvania wrote its answer down, in a 25-page letter.

In October 2024, Unbound Academic Institute applied to open a cyber charter school in Pennsylvania; Chalkbeat reported that "Both Unbound and Valenta would run on the 2 Hour Learning model." On January 29, 2025, the state's Department of Education denied the application in writing. A single deficiency would have been grounds for denial, the letter notes; the department "has identified deficiencies in all five of the required criteria."

Some of the reasons are mundane: "no petitions or letters of support," gaps on insurance and finances, a board that "has not yet met," and no "list of courses that would be offered to students." Then comes the fifth criterion — whether the school could serve as a model for others — and with it the AI. The department wrote that "the artificial intelligence instructional model being proposed by this school is untested," and that because Unbound had not been approved for a virtual charter at the time of its hearing, "there is no data that supports the efficacy of this model." Unbound listed no specific goals for the state's own tests, including the PSSA. And in footnote 17 the department took up the growth numbers directly: the NWEA MAP evidence "does not include results that can be translated or compared to PSSA results for similarly situated Pennsylvania schools," so Unbound's "testing results cannot be substantiated or used as a suitable measure of potential performance."

None of this makes Pennsylvania anti-AI. The same letter says, "Artificial intelligence (AI) presents unique opportunities that educators across Pennsylvania are exploring through effective, safe, and ethical implementation."

The reaction went the way you'd expect. Chalkbeat called it "a scathing denial"; a spokesperson for Price didn't immediately respond to a request for comment, though Price had told the outlet she believes the model will revolutionize education. The president of the Pennsylvania State Education Association, a teachers' union, said two hours of AI-guided learning could not "replace direct instruction from a certified teacher." The state's school boards association called it a "flawed application" in its push to change how cyber charters are paid for.

Does that settle it? No, and Pennsylvania's own record shows why.

• A denial grades an application, not a model. Much of this one is paperwork.

• Pennsylvania rarely approves cyber charters at all. Its January 2024 approval of one was the first time in eight years, and that applicant had been turned down twice before.

• "No data" meant no data yet. The department tied it to the time of the hearing. Arizona has since started to supply some, short of the predictions but with that 39 percent among full-year students.

• The door stayed open. The letter offered an appeal or a revised application. As of October 13, 2026, the department's applications page lists no revised application from Unbound, and the appeal board's page lists no Unbound decision. That isn't proof Unbound never appealed; it's what the public record shows.

• A pro-charter voice faults Alpha's effort. Jed Wallace of CharterFolk doesn't see the red-state authorizers who said no as "excessively inclined toward charter school opposition." Relaying others' assessments, he writes that Alpha "wasn't putting as much into these applications" as it appeared to put into its new private schools, and that "that lack of commitment" mattered "as much as anything else."

Alpha's own reading is simpler. By the founder's count, in a March Instagram post the newsrooms cite, Alpha had applied to open charters in at least 10 states; only Arizona had said yes. "Unfortunately, change is hard," Price said in the post.

So set the two states side by side. Pennsylvania said what it needed to see (goals on its own tests, results comparable with its own schools), found them missing, and published its reasons. Texas's board voiced similar doubts and voted the charter down; the state's education agency then helped Alpha's affiliates reach districts another way, which Gustavo Reveles, a Democratic board member, said "certainly raises a red flag that perhaps there's ways to circumvent that concern." One state put its standard on paper. In the other, the standard so far is one sentence from the governor's office, and the agency hadn't, by October 1, answered the newsrooms' questions in months.

Imagine next spring's growth chart

None of what follows has happened. It's my extrapolation from these documents, not a forecast about any district, school or company.

It's May 2027. Houston releases its pilot results: a clean chart, a line climbing steeply, a growth multiple in the caption. Every child on it was picked because they already scored above 60 percent, so the chart can't say what the software added, but it travels anyway — into a presentation about growing Future 2 toward the superintendent's goal of 100 campuses by 2031 (only two of today's nine use Alpha's tool), and into a one-page explainer for the next round of districts, the kind TEA helped draft the first time.

Now picture a family with one child at a voucher-funded private campus and another at the public school down the street. The first child's report shows growth at some multiple of the national pace, on a norm-referenced test the school chose. The second's says "Approaches Grade Level" in reading. Which child is doing better? There's no exchange rate. Pennsylvania found that Unbound's MAP results couldn't be "translated or compared" to its own test, and Texas's voucher law lets the two systems keep separate books.

Push it one step further, because the technology is heading there. Mastery-based software is built to decide when a child has learned something and move her on. Imagine it also writes the progress report (the growth chart, the badges, the note home) from its own logs. Who checks it? Even MAP's maker, remember, doesn't verify the data schools report. And a parent who asks for the contract may hear that the district has asked the attorney general to withhold it, as Houston did with the newsrooms.

Then the 2027 Legislature takes up the governor's proposal to limit classroom screens (he said in August that technology should serve specific lessons, "not as a substitute for teachers"), and a pilot the state's own agency helped set up has to fit under a cap on screen minutes. In Arizona, a school's own page still says the state results are on their way. And the study from Harvard, or the Alpha-funded one at MIT, arrives after Alpha's network has doubled again.

None of that requires anyone to act in bad faith. It only requires promising, piloting and measuring to keep happening on separate scoreboards.

Who's asking for proof, left and right

What do the people who govern this, study it and argue about it say? More of them agree than you might expect.

Start with Texas politics. Abbott, who has received more than $1.5 million in political donations from Price, according to the newsrooms, didn't agree to an interview or say directly whether he supports the platform in schools. His Democratic opponent, Gina Hinojosa, called Houston's plan to expand Future 2 to 100 campuses "Greg Abbott's plan to experiment on our children with AI" (a campaign line, about a model only two of whose schools use Alpha's tool). The governor appoints the education commissioner, and Hinojosa has vowed to fire Morath on her first day in office.

On the state board, the skepticism crosses party lines. Republican vice chair Pam Little, who voted against the charter, says: "I don't want anything AI in our schools, especially at the lower grades." Keven Ellis, also a Republican: "I'm just a little skeptical of those types of gains." Julie Pickren, a Republican who voted for the charter, was thrilled that Alpha's private schools had joined the voucher program: "Thank you for not giving up and looking for a way to serve children." In Arizona, the state superintendent of public instruction, Tom Horne, calls the two-hour model "definitely inadequate."

Among people who study schools, the request is for evidence. MIT's Justin Reich: "I don't believe their claims that typical students will see rapid improvements." Jennifer Steele of American University: "as a scalable model for public schools — even public charter schools — there is no evidence that it works." David DeMatthews of the University of Texas at Austin: "It'd be one thing if they were approved as a charter and they did have a track record and they could show evidence. We don't have any of those sorts of things."

Charter reformers want the same thing. Van Schoales, writing for the Fordham Institute, a pro-charter think tank, says "No outside study supports any of it" and hopes authorizers "insist on documented results," while saying he'd "keep an open mind if Alpha opens its books and classrooms to outside researchers and independent evaluation." Dan Meyer, a math educator who works at the curriculum company Amplify (his post says it isn't endorsed by or affiliated with Amplify), writes that Unbound's "poor outcomes shouldn't be the last word on 2 Hour Learning but they should be the loudest," since they show "it is far harder to make successful students than it is to select them in advance." Piper calls Alpha's "2x growth" figures "massaged to the point of being useless for understanding what kids are learning," then adds a note for the critics: "I think the critics are right, but I think they could also do a lot to make their case more persuasive."

Then there's the argument that the gate itself is the problem. A report for the American Enterprise Institute by Ian Kingsbury and David T. Marshall, which doesn't discuss Alpha, concludes that charters "must evolve toward a parent-centric, free-market orientation or face decline," and warns that the alternative "cedes innovation to entrepreneurs unbound by authorizers and state mandates." Wallace states the dilemma from both sides: screen weak applications out and they may reappear "as publicly funded private schools under far looser rules," but keep turning innovators away and that may be "evidence the charter model itself has become too restrictive."

Line the voices up and most of them — from a Republican governor's office to a pro-charter think tank — end up asking for the same thing: proof of results, checked by someone other than the company. The live argument is over what should happen when the gate says no.

What does this mean for you?

Here's what you can do this fall, in Texas or anywhere a district is weighing an AI program:

• Look up the state's numbers yourself. In TEA's reporting system, search a school by name (pick 2024-25; the newest year shows only attendance so far), open "STAAR Performance," and read the state, district and campus columns across years, noting which level any "passing" figure means. TXschools.gov has an A–F rating report for every campus, and the Family Portal has your child's own results. These cover public schools only.

• Ask what test a growth claim rests on, and how many children took it. "2.6 times faster" is a MAP figure, and Pennsylvania found Unbound's MAP results couldn't be compared with its own test. At Texas Prep, the tested grades held about two dozen children; at Unbound, results split sharply by whether students were there all year.

• Ask how many students use it, and how much. Offered isn't the same as used: when the University of Maryland offered students an AI tutor, only 15 percent ever used it. Ask how much screen time it adds, and who remains the teacher of record.

• Know which pilot your child is in. Houston's is only for students who already score above 60 percent; Fort Davis and Aldine aim theirs at students who need help. Ask how the district will tell what the software added.

• If your district runs a pilot, ask for documents. Request the contract, the evaluation plan and the data-sharing terms. TEA's page on the Public Information Act notes that a request "must ask for information already in existence," so ask for papers, not explanations. Houston asked the attorney general to withhold its contract; ask for yours anyway.

• Vote, then speak up. State Board of Education seats are on the ballot; early voting runs October 19 through October 30, and Election Day is November 3. The board meets November 16–20, and public testimony is two minutes, in person, by registration. As of October 13, 2026, TEA lists no proposed commissioner rules open for comment.

• In Arizona, the official 2026 school results are on the Department of Education's data page; letter grades are due by November 1, on a tentative schedule, though first-year schools, Unbound among them, don't get one.

• In a voucher-funded private school, ask which nationally norm-referenced test it gives, and ask to see the results.

The lesson, as I see it

A performance claim has three parts: a number, a test, and a count of children. The claim made to Texas officials in May 2025, as reported, came with a number. The state supplied the other two once that year's results were in: its own test said 21 percent, at the lowest passing level, for about two dozen children.

The governor's office wrote the right sentence: any tool must "prove results for students." What it doesn't say is on which test, for how many children, compared with whom, and whether the proof comes before a pilot or after one. Pennsylvania answered those questions in a denial letter. Arizona is answering them in public, a year at a time. In Texas, the answers will come from pilots already under way, one limited to students who were already ahead, under a contract Houston asked to keep from the newsrooms.

What should you watch? The Texas election on November 3, and the state board's meeting November 16–20. Houston's spring results, and which children they count. Unbound's second-year results on Arizona's tests. Any ruling on Houston's contract. And the independent research Alpha says has begun.

My vote? Before a state agency helps put an AI program in front of children, someone should write down what would count as success, on the state's own test, and publish it before the first login. It's a modest bar. Alpha's co-founder set it herself when she said the proof would be in the pudding.

If a school is doing well, the state's report will say so. If it isn't, the brochure will say so anyway.

If you remember the 2024 headlines, you may assume AI robocalls are simply illegal; the FCC's own press release said so in capital letters: "FCC MAKES AI-GENERATED VOICES IN ROBOCALLS ILLEGAL." The ruling underneath is narrower. It confirmed that the rules on artificial voices "encompass current AI technologies that generate human voices," which means a caller using one needs your permission first; the point, the FCC wrote, is that consumers "can themselves choose whether to receive them."

That permission is older than the technology. Since 1991, federal law has barred calls to a cell phone using "an artificial or prerecorded voice" — emergencies aside — without "the prior express consent of the called party." (Your landline gets weaker protection; more on that shortly.)

On August 31, Club for Growth asked the FCC to set that requirement aside for what the agency's notice calls "noncommercial, political calls to wireless telephone numbers using an artificial or prerecorded voice – including an AI-generated voice – without obtaining prior express consent from the call recipient." In a statement, the group says its petition asks the FCC to treat political speech "the same way it already treats wireless calls about package deliveries, bank accounts, and doctor's appointments." Replies are due Monday, October 19 — two weeks before Election Day. So it's worth reading the package rule to the end.

So what does a delivery company get to do?

Less than the comparison suggests. The exemption belongs to "a package delivery company" (not the store that shipped your order), and its first condition is the one in this piece's title: "The notification must be sent only to the telephone number for the package recipient." It can't carry "telemarketing, solicitation, or advertising content," and it's limited to "one notification (whether by voice call or text message) per package" (plus up to two more if you weren't home to sign).

The other two analogies come on similar leashes. A bank's fraud alert must go to its own customer's number, is "strictly limited" to fraud, data breaches and money transfers, and must honor opt-outs "immediately." A doctor's office may call only the number "provided by the patient," about things like appointments and lab results, at most once a day and three times a week.

What do the three have in common? Each limits who can be called to the person the call is about, and none may sell anything. That's the shape of the power Congress gave the FCC: it may exempt cell-phone calls "by rule or order," but only calls "not charged to the called party," and only on conditions that protect privacy.

The petition asks for different conditions. According to the Washington Times, the group wants the calls allowed "ahead of the Nov. 3 election" under "the same conditions that apply to landlines, including no more than three calls per 30 days, an automated opt-out mechanism and a company do-not-call list." On a landline, a noncommercial recorded call needs no consent if "the caller makes no more than three calls within any consecutive 30-day period to the residential line." The opt-out must come "within two (2) seconds" of the caller naming itself, a stop request may take "ten (10) business days" to honor, and it binds "the particular entity making the call (or on whose behalf a call is made)," not the next caller.

Read "the caller" again. The statute requires any exemption to set the number of calls "a calling party may make to a particular called party," so the count runs per caller. A coalition led by the National Consumer Law Center, which opposes the petition, spells it out: the limit "applies per caller," so "every campaign, political action committee, volunteer, fundraiser, or organizer can make up to three calls." Even the landline safeguard is young — before a December 2020 FCC order, "there was no limit" on such calls, and the cap took effect only on July 20, 2023.

Where does the request stand? As of October 16, 2026, it's pending. The FCC's consumer bureau put it out for comment on September 4 (a call for views that commits the agency to nothing). The Republican-led FCC "could rule on it as soon as late October," reports the Associated Press, which calls Club for Growth right-leaning and notes that if the petition is granted, "political groups of all stripes could amp up their use of AI." It isn't on the tentative agenda for the October 29 commission meeting, though that settles nothing about timing.

Isn't this just free speech catching up with the phone?

It's a serious argument, and it deserves its strongest form.

Political speech sits at the core of the First Amendment. "We think the Constitution protects a conversation with a voter at least as highly as a delivery update," the group's president, David McIntosh, said in AP's report. In 2020, political consultants challenged this very rule at the Supreme Court and won the argument but not the prize: in the words of Justice Brett Kavanaugh's opinion announcing the judgment, the plaintiffs "still may not make political robocalls to cell phones." Six Justices found that a 2015 exception for government-debt collection unconstitutionally favored that speech over political speech, but seven voted to strike the exception rather than the rule. Justice Neil Gorsuch, in a part of his opinion no other Justice joined, called the rule "a content-based restriction that fails strict scrutiny."

Then there's parity. A recorded political call to your landline already needs no consent within the landline limits, while 98% of Americans now own a cellphone of some kind — so from the caller's side, a rule that turns on the device looks arbitrary. The petition, as the Washington Times quotes it, says "Outdated rules create litigation risks" for the group's AI calling, and with "$500 in damages for each such violation" in the statute, that worry isn't idle. The group also wants to reach voters "more effectively (e.g., in more languages)," as Arizona's Family quoted the petition, and to "correct polling inaccuracies," as the Times reports it. (The FCC has said the landline exemption covers "political polling.")

The consent rule already leaks, too. Under federal law, campaigns using live human callers need no consent and needn't disclose AI, the Center for Democracy & Technology notes, and political texts sent by hand need no consent either. By one call-blocking company's count, Americans got 15 billion political text messages in 2022 against 384 million political calls. As I wrote in August, the AI-voice protection lives in robocall law: it aims at automated campaigns, not at a person dialing by hand. The group says its calls aren't robocalls at all; as Reuters summarized it, "a human initiates the dial to a cell phone and then an AI agent handles an interview." And some state and federal laws against deception and voter intimidation, AP notes, would still prohibit certain misleading election messages.

So why keep consent? Because it's the one protection that works without anyone having to prove a lie. Calling cell phones with a prerecorded voice without consent "is a violation of the TCPA regardless of the caller's intent," the FCC said in 2023, assessing $5,134,500 against two political operatives and a company over 2020 robocalls that told voters a mail ballot would feed a database used "to track down old warrants." It counted only the 1,141 calls to cell phones, since on landlines political calls "may be legal provided certain conditions are met." Deception laws work after a message lands, and someone has to show what it did — consent works before the phone rings. As for the AI-interview argument, the FCC said in 2024 that the law allows no "carve out of technologies that purport to provide the equivalent of a live agent."

India let the calls come first

What happens when a country lets AI campaign calls run and writes the rules afterward? India has tried it.

Before its 2024 national election, "More than 50 million AI-generated voice clone calls were made in the two months leading up to the start of the elections in April," a large business messaging operator told WIRED (a company's claim, not an audited count). A year earlier, in state elections, voters who got one vendor's AI calls "didn't know they'd been listening to an AI," WIRED reported.

The Election Commission of India's first letter to the parties came on May 6, 2024, weeks into a national vote scheduled to run from April 19 to June 1: pull deepfake audio and video "within three hours of bringing it to their notice." A report for the Center for Media Engagement found the "follow-ups were patchy and had little impact," and the researcher Prateek Waghre notes that the letter "did not specify any particular mechanism" for that clock. Rajiv Kumar, India's chief election commissioner during that vote, said the commission had been able "to kind of manage and control the menace of deepfakes."

Labels came next. In January 2025 the commission directed parties toward "prominent labelling of AI-generated and Synthetic content," and in October, for the Bihar campaign, it spelled out what a label means: one covering at least 10 percent of the display on AI images and video and, for audio, present "during the first 10 per cent of the duration," plus the maker's name. By its own terms, that advisory stands "until further orders," and in April 2026 the commission repeated that campaign AI content must be labeled as AI, with the maker named.

Now look at whose consent those rules protect. The commission "called for restraint on" unlawful content made to mislead voters that "misrepresents the identity, appearance, or voice of any person without their consent" — the person whose voice is borrowed. The American rule protects the person whose phone rings, "the called party." India let the calls run, then asked for labels; the United States asked for consent first and is now being asked to drop it, weeks before an election.

The counterpoint is fair. India's instruments are advisories and directions aimed at "political parties, candidates and campaign representatives," not statutes, and India requires pre-certification of campaign voice messages as political ads, pre-clearance with no American counterpart. The harm may also have been smaller than feared: two Indian fact-checking groups found synthetic media "did not make up a significant share of the false claims they debunked" in 2024. And campaigns there relied on AI to help them navigate "22 official languages and thousands of regional dialects," the same language case Club for Growth makes here.

Picture the final stretch with a waiver in hand

What follows is my extrapolation rather than a forecast, and it assumes a grant that copies the landline rule, as the petition proposes.

Start with the arithmetic. Three calls per caller per 30 days sounds modest until you count the callers. Suppose ten committees care about one close House race: campaigns, parties, PACs, issue groups. That's up to thirty recorded or AI calls to one phone in a month, every one within the rule.

Then the stop button. Count back ten business days from Tuesday, November 3, and you land on Tuesday, October 20. If a waiver came in late October, as AP says it could, any stop request you made after that could lawfully go unhonored until after Election Day — and it would reach only the caller you asked. (On September 30 the FCC said consumers are "understandably frustrated" when robocalls continue after they revoke consent, and asked whether to shorten a ten-business-day window under a parallel rule.)

Then the call itself: a human starts the dial, an AI handles the interview. One AI texting vendor already says, according to CDT, that its platform can "feed each exchange into an individual voter file." Imagine a call that does the same: a poll, a pitch and a data intake at once, in your language. Nothing in federal law would require it to say it's AI. Naming the sponsor, as Newsweek put it, is "different from telling someone the voice is artificial," and the FCC's 2024 plan to require AI disclosure is, as of October 16, 2026, still only a proposal.

Who's lining up, and on which side

Start inside the FCC. Commissioner Anna M. Gomez, the sole Democrat among what AP counts as three active commissioners, warns of "a tsunami of robocalls and misinformation" and says a grant "would bring chaos so close to Election Day." Chairman Brendan Carr hasn't taken a public position as of October 16; a spokesman declined immediate comment to Reuters. (On a 2024 proposal about AI calls, Carr, then a commissioner, saw "a risk of overdoing it early on" with AI rules and supported the proposal anyway.)

Outside the FCC, the Center for American Rights filed in support, urging "a limited exemption for noncommercial political calls placed under particular conditions," modeled on the package, bank and health care rules. The coalition led by the National Consumer Law Center, with signers ranging from Common Cause to the National Hispanic Media Coalition and the Sikh American Legal Defense and Education Fund, asked the FCC to "deny the Waiver Petition before the upcoming November midterm elections." (So the language argument has champions on both sides.) NCLC's Patrick Crotty calls the petition "a strong contender for the gold" among bad ideas and says that without the consent rule, "We'd probably expect something closer to 15 billion robocalls." CDT's Tim Harper warned in AP's report that a ruling this close to Election Day would open "a huge opportunity for abuse during a period where harm has outsized impact." In Nevada, the ACLU's Athar Haseebullah worries about "folks' phone lines being bombarded."

The sharpest line may come from the other side of the courtroom. Eric Troutman, who defends companies in TCPA class actions, grants that "the petition does seek limits," but says a free pass for political AI calls to cell phones "feels like an awful idea and one that is certain to be abused."

What does this mean for you?

• Weigh in by Monday, October 19. Anyone can file a reply comment in CG Docket No. 02-278 through the FCC's Electronic Comment Filing System. In the short form, type 02-278 in the "Proceeding(s)" line, add your name and address, and say what you think. (That walk-through comes from a consumer group that wants a no; the form takes a yes just as readily.) Name the Club for Growth petition, since the notice also covers a separate one about mass texting.

• Say why it matters to you. On a prepaid or pay-per-minute plan? The law allows these exemptions only for calls "not charged to the called party," and the consumer coalition argues prepaid users "are effectively charged for each cell phone call they receive." Run a business from your cell, speak a language other than English, or work in polling? Tell the FCC which way that cuts for you.

• Know what protects you now. A recorded or AI voice may not call your cell about politics without your prior consent. The law lets you sue for "$500 in damages for each such violation" (up to triple if willful or knowing), and you can file a complaint with the FCC, which says it doesn't "resolve individual unwanted call or text complaints" but uses them as "the basis of potential enforcement actions."

• Don't count on Do Not Call. It covers calls "encouraging the purchase or rental of, or investment in, property, goods, or services," and a campaign asking for your vote isn't selling anything.

• If the waiver is granted (and on your landline today), opt out of each caller. Each one counts separately, may take up to ten business days to stop, and must then honor your request for five years.

• Don't expect the voice to say it's AI. As of October 16, 2026, no federal rule requires it to.

The lesson, as I see it

Consent is an unglamorous protection. It doesn't judge what a caller says, doesn't need a court to decide whether a message lied, and doesn't care whether the voice is a recording, a clone or a chatbot. It asks one question: did you agree to this?

Last month I argued that "laws aimed at a tool age at the speed of the tool." The 1991 voice rule looks like a tool law, yet it aged well, because underneath it is a consent law; in 2024 the FCC applied it to AI on the simple observation that no person is speaking.

What should you watch? AP says a ruling could come as soon as late October. If one does, read past the headline to the conditions: whose number, how many calls per caller, how fast a stop works, and whether the relief ends with this election or becomes the floor for 2028 (the FCC's notice calls the request "a limited waiver" but notes that the petition "also seeks an exemption").

My vote? Keep consent on the phone in your pocket. For landline callers who want more than three calls, the FCC's own answer in 2020 was that they "can simply get consumer consent." The package rule earns its exemption by calling only the person getting the package. A political call to a stranger can't pass that test, so it should have to earn something else: your yes.

Consent is the whole story here, so consider this an invitation rather than a robocall: if the piece helped, pass it to one person who'd want a say before replies close on Monday, October 19.

The first is the analysis the state Senate's labor committee prepared for its April 8, 2026 hearing. The bill it describes protected any "worker," defined as "any natural person who is an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in any workplace." Under "Proponent Arguments," the analysis quotes the bill's sponsor, the California Federation of Labor Unions, and among its examples are Amazon Flex drivers, "independent contractors who sign up for Amazon deliveries via an app." "Late deliveries," the sponsor wrote, "can lead to automated firing by the app's automated decision-making system." (That is an advocate's account. In 2021, when Bloomberg reported on a Flex driver cut off by automated email, Amazon called drivers' claims of unfair termination anecdotal and said it does "investigate all driver appeals.")

The same document carried a caution from the committee's own staff: the author "may wish to consider if and how the requirements in SB 947 may conflict with those of AB 1340," the 2025 law that lets rideshare drivers bargain collectively.

The second document is the law Gov. Gavin Newsom signed. It protects employees, and an employee is "any person employed by an employer." Somewhere in between, the Assembly "struck the applicability of this bill to independent contractors," as the Senate's analysis for the final vote put it. KQED was blunter: "Notably left out of the SB 947 party: rideshare drivers, who are classified as independent contractors under Proposition 22."

In short: if you are on a payroll in California, then from July 1, 2027, software may not fire or discipline you on its own, and when it is the main reason, a human has to check it. If you drive or deliver for an app as an independent contractor, this law doesn't reach you. (Whether someone truly is an employee is a legal question, not a company's label; drivers classified as contractors are outside it.)

So what does SB 947 require?

Its author, Sen. Jerry McNerney, calls it the No Robo Bosses Act, and his office bills it as the first such law in the nation. Newsom signed it on September 30, 2026, a year after vetoing its predecessor, SB 7, over "unfocused notification requirements" and "overly broad restrictions" (as I wrote in September, California had vetoed a transparency bill). This version drops the advance notice. The governor's office says it ensures "real people review automated employment actions." It takes effect July 1, 2027.

It works in two tiers, and the gap between them is most of the law.

Solely. An employer "shall not rely solely on an ADS when making a disciplinary or termination decision." An ADS, or automated decision system, is any computational process built on machine learning, statistical modeling, data analytics or AI that issues simplified output, "including a score, classification, or recommendation," that is used "to assist or replace human discretionary decisionmaking and materially impacts natural persons." To be clear, AI can still be part of a firing decision — it just can't be the only part.

Primarily. If an employer "primarily relies upon an ADS output" to discipline or fire you, it "shall direct a human to corroborate the decision using data that was collected or used to produce the ADS output or other relevant corroborating or supporting information." Read that again: the human may check the machine against the machine's own inputs (yes, that counts), or look further, at sources ranging from personnel files to "Witness interviews, that may include relevant online customer reviews." If the employer can't corroborate the output, or the reviewer finds it "inaccurate, incomplete, or misleading," the output can't be used.

When software was the main basis, the employer owes you "a written postuse notice at the time the employer informs the employee of the decision" (postuse, so no warning beforehand), saying that a human "reviewed the decision and corroborated the ADS output" and giving contact details for a human you can ask. You may also request "a meaningful, objective description of the employee's own data used by the ADS."

It covers public employers as well as private ones, from "all branches of state government" to school districts (the University of California only "upon agreement by the regents"). Only the Labor Commissioner and public prosecutors can enforce it, and the civil penalty is $500 per violation, the same $500 figure as the emotion-reading ban I covered earlier this month, which Newsom signed the same day. And a union contract can switch the law off if, among other things, it "explicitly waives this part in clear and unambiguous terms" and "provides protection from algorithmic management."

How the drivers fell out of the bill

How do the workers who made the case for a bill end up outside it? The record is unusually clear (bear with me; the order matters).

The full Senate passed SB 947 29–9 in May, contractors and all. In June, in the Assembly's privacy committee, your right to sue came out, leaving enforcement to "the Labor Commissioner or public prosecutors." The contractors went out in the floor amendments of August 21, along with the bill's limit on "deactivations" (the industry's word for cutting a driver off an app) and the requirement that a human reviewer "conduct an independent investigation." The Senate concurred 28 to 10 on August 31. Before that vote, McNerney told his colleagues that dropping the contractors had removed another stumbling block, for a different set of people than the right to sue had been, according to Digital Democracy's machine transcript.

Weren't the drivers covered somewhere else?

It's the strongest objection, and it deserves a fair hearing.

Uber and Lyft, in the letter the April analysis quotes, argued that covering contractors "undermines that process with top-down rules," the process being AB 1340's bargaining, and that Prop 22 "fully governs certain processes for app-based workers, including appeals procedures for deactivations." A coalition led by the California Chamber of Commerce asked that contractors be taken out of the definition of "worker." And in vetoing SB 7, Newsom said that disciplinary, firing and deactivation decisions made with an ADS were "partially covered by forthcoming California Privacy Protection Agency regulations," which he said would let "employees and independent contractors" better understand how their data is used.

So what do drivers classified as contractors have? Three things, on paper.

• Prop 22. The 2020 ballot measure makes an app-based driver "an independent contractor and not an employee" when four conditions are met, and says companies "shall provide an appeals process" for drivers whose contracts they terminate. (The state Supreme Court upheld it in 2024.)

• AB 1340. It makes deactivations a mandatory subject of bargaining, and any sector-wide agreement must address an "Appeals process for deactivations" and drivers' representation in those appeals, unless both sides agree to waive it. On September 9, the state certified the California Gig Workers Union to bargain for Uber and Lyft drivers, which Uber called "the next step in delivering on AB 1340."

• The privacy rules. From January 1, 2027, the privacy agency's rules can apply when a covered business uses automated technology to make decisions about "independent contracting opportunities," including "Demotion, suspension, and termination."

Now read the fine print on each. Prop 22's appeals clause requires "an appeals process" and says nothing about who decides it. AB 1340 leaves each company "exclusive control" over its "software, contract terms, algorithm," and the first contract is still ahead; meanwhile, drivers have charged that their challenges to deactivations are "typically handled by automated systems." (Uber and Lyft told lawmakers in their letter that they have "offered deactivation appeals and reviews processes.") The privacy rules reach only decisions made "without human involvement," and a business can skip the opt-out by offering "a method to appeal the decision to a human reviewer who has the authority to overturn the decision."

There is a fair case, the one Uber and Lyft made, that negotiation suits drivers better than statutory mandates. But none of these routes says what SB 947 says to an employee: software can't be the only basis, and when it is the main one, a human must corroborate it or the output can't be used. The drivers were routed somewhere. They weren't routed to that rule.

Spain wrote its law for the riders

What does it look like when a law starts with the workers California left out?

Spain's 2021 "Rider Law" began as an emergency decree that May to guarantee labor rights for people who deliver through digital platforms, took effect in August and then passed Parliament as Law 12/2021. It did two things. It gave works councils (a company's elected worker representatives) a right to be told the parameters, rules and instructions behind the algorithms or AI systems that shape working conditions, hiring and keeping a job. And it presumed that people paid to deliver goods for a company that organizes, directs and controls their work through algorithmic management on a digital platform are employees, a presumption the company can try to rebut. Both provisions are still in force, unchanged.

Then the EU went further. Its platform-work directive, adopted in 2024, says that "Any decision to restrict, suspend or terminate the contractual relationship or the account of a person performing platform work or any other decision of equivalent detriment shall be taken by a human being." That covers anyone doing platform work, "irrespective of the nature of the contractual relationship." Every member state must turn it into national law by December 2, 2026.

Spain wrote its delivery riders in. The EU wrote in everyone who does platform work. California wrote its app drivers out.

Now the fair counterpoint, and it is a big one. Spain's presumption covers delivery only, not ride-hailing. Spain's own labor ministry says the directive reaches further than Spanish law in scope and in the rights it protects. And Spain has only reached a public consultation on its version: comments closed August 14, 2026, and as of October 9 no draft bill had been published.

The platforms adapted. Deliveroo, citing a small market share (Spain was "less than 2%" of its gross transaction value) and, in TechCrunch's reading, worried about the cost of the new rules, said it would cease operations in all of Spain on November 29, 2021. Glovo's owner, Delivery Hero, announced only in December 2024 that Glovo would move its Spanish riders to employment, "to avoid further legal uncertainties." Uber Eats said it would stop working with self-employed riders only in January 2026, after the labor ministry threatened criminal action, adding that those riders could stay on as employees of its partner fleets (subcontractors, that is, not Uber).

Ane Aranguiz, a labor-law scholar, still called the law a breakthrough in "opening the black box of algorithms" as some platforms worked around it in 2021. In 2025, Fairwork researchers (in a study funded by a foundation of the CCOO union) found the sector still marked by low pay and "a lack of algorithmic transparency," with Glovo relying on "outsourcing through delivery fleets."

Coverage in Spain was slow, partial and dodged — but it was where the law began. In California, it was what the bill shed on its way to a signature.

Picture the summer of 2027

What follows is my extrapolation from the text, not a forecast about any company.

It is July 2027, and a productivity system at the California warehouse where you work flags you; your manager checks the same scan data the system scored and signs off. Your notice says a human "reviewed the decision and corroborated the ADS output," and every requirement is met, though the check came from the machine's own inputs. Did your employer "primarily" rely on the system? That word has no definition, so the first case before the Labor Commissioner could turn on a dashboard and a manager's signature.

Now picture a rideshare driver, classified as a contractor, cut off the same week. SB 947 doesn't apply. Prop 22 promises an appeals process, and the privacy rules can apply only if no human was involved. Whether a person hears that appeal could come down to what the new union wins in its first contract.

And picture the same kind of app in Madrid once Spain transposes the directive: a human being must take the decision to cut off any account, contract or no contract. Same work, two rulebooks.

Here is where things get interesting. A union contract that "provides protection from algorithmic management" can switch SB 947 off, and AB 1340 puts deactivation appeals on the drivers' bargaining table. The strongest rules on algorithmic firing in California may yet be written by negotiators — for employees and drivers alike — rather than by the Legislature.

Too weak, too vague, or a breakthrough?

Who's right? That depends on what you wanted from the law.

Labor got a law and wanted more. "It should be a stronger bill," Lorena Gonzalez of the sponsoring federation said in Khari Johnson's September 30 report for CalMatters. Nicole Moore, president of Rideshare Drivers United, wrote, as KQED reported, that "An algorithm decides what work we get, what we are paid, how our performance is judged, and too often whether we can work at all." Annette Bernhardt of the UC Berkeley Labor Center called the day's package of laws "a breakthrough moment in tech policy," and the Electronic Frontier Foundation, which praised the 2025 version for covering "employees and contractors," backed this one too.

Business and the tech industry see a vague standard and a litigation risk. Chamber of Progress, a tech-industry group, urged a veto because "primarily relies" — "that critical term is never defined" — leaves employers "no objective standard." The coalition led by the California Chamber of Commerce warned of "costly litigation for even the smallest of employers." SHRM, the HR profession's association, reads it to mean that human involvement "cannot simply amount to rubber-stamping an algorithm's recommendation," though it "strongly opposed the bill."

The right isn't of one mind either. Steve Hilton, the Republican nominee for governor, came out in full support, CNBC reported, calling the California Chamber's complaint about human review "a ridiculous thing for them to say" and adding, "In some ways, I don't think SB 947 goes far enough." From the libertarian side, Adam Thierer of the R Street Institute told Reason that California is "once again attempting to position itself as a super regulator for the entire nation," though he was discussing Newsom's separate September order on AI oversight, not this law.

Put them side by side and the critics cross over: the sponsor and the Republican nominee both say the law stops short, while the tech industry says its key word is too vague to apply and business groups warn of lawsuits. Both complaints can be true at once.

What does this mean for you?

• If you work for a California employer, public or private, mark July 1, 2027, when the law becomes enforceable.

• If you're disciplined or fired after that and software was the main basis, expect a separate written notice when you're told, with contact details for a human. Keep it.

• Then ask for "a meaningful, objective description" of your data. It's a description, not a copy.

• Complaints go to the Labor Commissioner; you can't sue under this law yourself. Retaliation is prohibited, and retaliation complaints can be filed online, in most cases within one year of the adverse action.

• In a union? Read your contract. It may waive this law in exchange for its own protections against algorithmic management. Ask your steward.

• If you manage people and a dashboard feeds discipline, the burden shifts to the employer once it's shown that a system was used, and "primarily relies" has no definition yet. Write down the human reasoning behind each decision.

• If you drive or deliver for an app as an independent contractor, this law doesn't cover you. If Prop 22 covers you, you have its appeals process. If you drive for Uber or Lyft, ask your new union what it wants on deactivation appeals. And from January 1, 2027, the privacy rules can apply where a covered business decides without human involvement, though it may offer a human appeal instead of an opt-out.

The lesson, as I see it

A law is its definitions. The promise is that software can't fire you on its own; the boundary is "any person employed by an employer," and the drivers the sponsor used to show why the law was needed stand on the other side of it. Compromise is how bills pass. It is still worth saying plainly who was left out.

What should you watch? July 1, 2027, when the law becomes enforceable. The drivers' union's first contract with Uber and Lyft. The privacy agency's preliminary look at employee data, where nothing had been proposed as of October 9, 2026. And December 2, 2026, the EU deadline, which Spain, for one, is approaching without a published draft. In Washington, a federal version has sat in a Senate committee since June.

My vote? Wherever software can cut off someone's income, a person should make that call — whatever the contract calls the worker. The EU has written that sentence for platform work. California has written half of it.

Know someone who drives or delivers for an app as a contractor, and someone whose shifts and reviews run through software? Hand this to both. Come July 1, 2027, this law covers one of them and not the other, and both deserve to know which is which.

This piece is about that buyer — shopping wholesale. Before you file it under outrage, a confession: most of what follows is paperwork. The headline number is a ceiling, the key record is a procurement form, and the label that matters most, "full and open competition," covers a narrower contest in federal law than it suggests in plain English. (Stay with me; the paperwork is the plot.)

In July, Immigration and Customs Enforcement (ICE) planned to award the work to Thomson Reuters Special Services (TRSS) without competition. In August, citing "industry feedback," it dropped that plan. On September 17, 2026, it signed a blanket purchase agreement worth up to $125 million with the same company, and the award record codes it "FULL AND OPEN COMPETITION." ICE said it received just one offer.

Was it a real competition? On paper, yes. Whether anyone else had a realistic shot, the public record can't tell you — and that gap is the story.

What ICE said it wanted in July

Why skip competition at all? ICE's July justification (an agency's written case for a no-bid award) proposed a five-year agreement worth up to $125 million, invoking an exception for unique or highly specialized services only one source can provide.

Hadn't other companies answered the call? They had. More than 50 vendors responded to a 2025 request for information, and ICE's market research initially found seven small and ten large businesses capable of this type of work. Then "HSI's requirement was revised for a proprietary requirement" (HSI is Homeland Security Investigations, ICE's investigative arm), and ICE concluded only TRSS could fulfill it. That sequence, Biometric Update noted, "does not, by itself, establish a violation of federal procurement rules."

So what was the requirement? According to Wired, the document called TRSS "the only contractor" able to provide "continuous monitoring of up to one million individuals and entities," with "real-time alerts" and "model-based risk scoring," plus "real-time alerting on last known location data" for people recently jailed or in contact with law enforcement, and something called "academic risk flagging" that it does not explain. The data, it said, had to be readily accessible to support "the presidential mandate of the identification of Voters Fraud, Immigration Fraud and National Security," as Democracy Docket reported.

(Every one of those phrases comes from the July plan, which ICE withdrew. The final agreement's work statement isn't public.)

A new code, a reversal and one offer

What changed between July and September? First, the code. On August 10, the Department of Homeland Security (DHS) re-coded the requirement under the industry code for credit bureaus in its acquisition forecast, the second re-coding in two months. The forecast describes the work as including "identifying potentially criminal and fraudulent behavior before crime and fraud can materialize." Is ICE buying credit reports? Not necessarily, Biometric Update cautioned; ICE "has not publicly explained its selection," and the change "could enlarge the group of bidders classified as small."

Second, the plan. On August 12, ICE updated its notice: "In response to industry feedback, the government no longer intends to sole source this requirement." The feedback itself was not made public, FedScoop reported.

Third, the award. The record signed September 17 names TRSS, shows "$0.00" obligated, keeps ordering open until September 29, 2031, carries the credit-bureau code and describes the work only as "DATA ANALYTIC SUPPORT SERVICES." Biometric Update called the one-bid outcome "notable," given the reversal "only weeks earlier."

What "full and open" means on a GSA schedule

So how does a one-bid contest earn the words "full and open"? Through the General Services Administration (GSA) schedules — standing contracts that companies hold and agencies order against. This agreement runs against a GSA schedule contract held by TRSS.

By statute, the procedures GSA sets for its schedules count as "competitive procedures," provided participation has been "open to all responsible sources" and orders "result in the lowest overall cost alternative" for the government. Federal acquisition rules agree that using the schedules "is a competitive procedure." So the label is how the law classifies a schedule order — but the contest ran among companies that already hold a schedule contract. Which companies received the final requirement, what ICE changed and why TRSS alone bid are, in Biometric Update's words, "what remains unclear from the public record."

Is one bid unusual? Not very. In 2010, the Government Accountability Office found one-offer competitions steady at "about 13 percent" of obligations in each year it studied, with factors that include "a strong incumbent, sometimes coupled with overly restrictive government requirements" (findings about federal contracting in general). Biometric Update had noted in August that TRSS "could ultimately win," given its "proprietary data, existing ICE integrations and cleared personnel."

What Thomson Reuters says CLEAR holds

What would CLEAR, Thomson Reuters' records platform, know about you? The company's own privacy statement spells out what CLEAR holds: the platform "generally offers access to core identity and vital statistics, including names, government-issued identifiers, driver's-license details, and death records," plus "marriage and voter-registration records," "federal and state court filings," "asset-ownership records" and more, and "law-enforcement subscribers may see more than financial-services users."

The data comes partly from "third-party business partners (including private data providers and data brokers)," and the statement carries a blunt notice: "We may sell your sensitive personal data." It concedes that "under some local data broker laws, we may be deemed a data broker," and a Thomson Reuters company is on California's data broker registry.

Who gets to search it? Its customers "include law enforcement agencies, welfare agencies, accredited financial institutions, law firms, and corporate compliance and fraud prevention teams." You can't — the products "are not licensed to everyone in the general public" — though you can ask for your own records.

(Disclosure: Reuters, the news agency, shares a parent company with the contractor; this piece cites no Reuters reporting.)

One caution: CLEAR is named in the withdrawn July plan, but with the work statement unpublished, no one outside ICE and the company can say which of these records, if any, the agreement covers.

Isn't this what investigators have always done?

The strongest objection is that little of this is new. ICE has bought Thomson Reuters data since 2008, Wired reports. From 2020 to 2025, the defense technology company CACI provided ICE a "continuous monitoring and alert service," with around $106 million obligated, according to FedScoop, and ICE's 2025 request for information said the service "must be able to monitor a million individuals or entities of interest."

Thomson Reuters makes its case plainly: its investigative products "are not surveillance tools and do not have surveillance capabilities." Much of CLEAR's data, "such as court and property records," is "publicly available," and "all of this data is licensable directly from third parties"; CLEAR "does not include information about an individual's citizenship or immigration status"; and its "standard terms do not allow the redistribution of CLEAR data to third parties." It told NPR it bars using CLEAR to find noncriminal immigrants or undocumented people for deportation "solely on the basis of the individual's immigration status," and that "we enforce it." On October 8, ExecutiveBiz reported that TRSS "has announced up to $127.8 million in recent federal contract awards," for work in "fraud detection, financial crime analysis, child exploitation investigations and public safety."

The defense crosses party lines. In 2024, the Biden White House strongly opposed the Fourth Amendment Is Not For Sale Act, calling responsible access to commercially available information "critical to scores of vital missions," including helping victims of child exploitation. That year the Fraternal Order of Police said the data lets investigators "connect the dots."

I take that case seriously. But set two claims side by side. The vendor says its tools "are not surveillance tools"; ICE's July plan described "continuous monitoring" with "real-time alerts." The vendor says its data is licensable from third parties; ICE called TRSS "the only contractor" able to provide the service. Both may be honest descriptions from different ends — and the documents that would settle it aren't public. Asked by FedScoop what safeguards prevent misuse, a DHS spokesperson said: "We will not comment on law enforcement sensitive methods."

In Germany, the threshold comes before the click

What would a rule look like? Germany has one, because its highest court insisted.

On February 16, 2023, Germany's Federal Constitutional Court held that the provisions letting police in Hesse and Hamburg run automated analysis of stored data were unconstitutional "because they do not contain sufficient thresholds for interference," falling "far short of the constitutionally required threshold of an identifiable danger." The powers "allow the police, with just one click, to create comprehensive profiles of persons, groups and circles," the court wrote, and could expose "many persons who are legally innocent" to police measures if the software wrongly flagged them.

Was that a ban? No. "In principle, it can be justified," the court said of automated analysis. What it demanded was order: to let police run the analysis before any identifiable danger exists, the legislature itself must fix "the type and scope of usable data and the permissible data processing methods," and where authorities fill in the details, they must document them and "publish their determinations."

Hesse had bought Palantir's Gotham software in 2017 and run it as hessenDATA, and its police had used the power "thousands of times each year." Hesse's provision could continue to apply, with some restrictions, until September 30, 2023, at the latest. Hamburg's was void.

Then the legislators moved. Hesse's parliament rewrote the law by June 2023 so hessenDATA could keep running. The new text, in force from July 12, 2023, sets tiered thresholds, names the kinds of police data that may be merged, requires an administrative rule that must be published and bars any direct connection to internet services (though results of targeted searches of government registers and individually saved internet records may be added as a supplement). Hamburg's government conceded its rule was not precise enough to ensure proportionality in each case and rewrote it on Hesse's model (in force February 5, 2025).

It is not a tidy success story. In June 2024, the GFF, a civil-liberties litigation group, "lodged a constitutional complaint against the amended Hessian Police Act." That December, Hesse amended the law again and allowed AI systems in the same analysis. As of October 9, 2026, the complaint is still pending.

To be clear, the comparison is between rules: Hesse's provision, as the court described it, applied to "personal data that has already been lawfully obtained" by police, while ICE is buying commercial records and analysis. But the questions Germany made legislators answer (which data, which methods, what threshold, published where) are the ones the American paperwork leaves open. DHS does publish privacy documents: an assessment of HSI's "commercial license plate reader data services" and a records notice whose analysis tools cover datasets "including commercial data and open sources." Neither sets a threshold like Germany's, and I could find no federal statute that does.

Five years of orders, four already placed

The agreement itself obligated "$0.00," but as of October 9, 2026, federal spending records list four orders under it, all signed September 29 and together worth about $7.2 million, each described only as "data analytic support services" for ICE or one of its offices or programs. The scenario below isn't on the public record. It's my extrapolation from documents that exist, and I would be glad to be wrong.

Start with the subscription I imagined on October 6. ICE's July plan described the wholesale edition: "continuous monitoring," "real-time alerts," "real-time alerting on last known location data." Picture an order that buys it for whatever list of people ICE chooses (the July figure was up to one million) and re-runs each file whenever a court docket, a deed or an address changes.

Then put a model on top. ICE's IT office is seeking help with its "enterprise strategy for artificial intelligence and data," including STELLA, a platform that "functions as a large language model" (a separate requirement, outside this agreement). The July plan already listed "model-based risk scoring," and Germany's court warned that such software can "begin autonomously producing further evaluations in the manner of 'predictive policing'." (FedScoop reports ICE recently retired an AI use case that predicted whether noncitizens would try to evade detection; why is unclear.)

Then widen the circle. ICE's July plan said TRSS data would check "school, benefit, immigration and other eligibility requirements," and Thomson Reuters markets CLEAR to school districts for "residency verification." Imagine a residency check, a benefit renewal and an immigration alert drawing on the same file — each defensible alone, together a portrait no one decided to paint.

The split runs through both parties

Who else is uneasy? People who agree on little else.

On the libertarian right, Cato's Patrick Eddington told FedScoop that most of the available research shows "you can't anywhere near consistently predict who is going to turn into a criminal," and software that encourages the belief is "a prescription for constitutional rights violations at scale." Rep. Andy Biggs of Arizona and two fellow Republicans introduced H.R. 7816 in March, a bill that would, among other things, stop law enforcement and intelligence agencies from "obtaining certain commercially available information" (its Title II is the Fourth Amendment Is Not For Sale Act). It "is in the first stage of the legislative process," per GovTrack, and its ban reaches records from communications providers, online accounts and devices, including location information, not obviously the court and property records at CLEAR's core.

From the progressive and civil-liberties side, a coalition including Public Citizen and the ACLU asked two Senate committees in August for that act, oversight hearings and contract transparency, arguing that the government "should not be permitted to purchase their way around the Fourth Amendment." The Center for Democracy & Technology's Jake Laperruque told FedScoop that "lawmakers have given them a bulldozer and simply trusted it will always be someone safe behind the wheel."

Set those voices beside the Fraternal Order of Police and a Democratic White House, and the fault line runs through each party rather than between them.

What does this mean for you?

• Ask Thomson Reuters what CLEAR holds on you. The privacy statement linked above lets you request "a copy of your personal information," limited to "the records referring unambiguously to you," and residents of certain states can also opt out of the sale or sharing of their information. Its own caveat applies to all of it: these rights "do not apply to everyone, they are not guaranteed."

• Know the deletion limits before you ask. Unless the law requires more, the company typically suppresses records only if you are "a judge, public official, or member of law enforcement," can show a "risk of physical harm" or are a victim of identity theft. It cannot delete what comes from government sources such as court dockets, and if your details change, "you will likely reappear." If an error sits in the source records, it may point you to "the originating source of the data."

• Californians: file one DROP request. It reaches every registered broker, the Thomson Reuters company included, and brokers have had to process requests since August 1, 2026. Public records stay out of reach; my October 6 piece explains how to file.

• Check your voter registration. Confirm your voter registration status with your state. Election experts and officials have raised concerns that the government's use of commercial data for immigration and election investigations "will lead to false matches," Democracy Docket reported. (No public document shows this agreement touches voter rolls; this is simple prudence.)

• Tell your members of Congress which rule you want. Civil-liberties groups want hearings and contract transparency; police groups say the data helps them "connect the dots." Both deserve a hearing, and so does Germany's question: what threshold comes before the click?

• Watch the agreement, not the headline. Search its number, 70CMSD26A00000008, in federal spending records. As of October 9, 2026, the largest of the four orders (about $2.7 million) is for ICE's Student and Exchange Visitor Program; none describes the work beyond "data analytic support services," so the next orders, and any work statement ICE releases, are where to look.

The lesson, as I see it

Biometric Update described the August reversal precisely: it "concerns how ICE planned to award the work, not whether the agency still wants the data, monitoring and investigative capabilities described in the deleted document." Whether the final requirement asks for less, the public can't tell. "Full and open" names a procedure; it can't tell you who could realistically bid, or what the agreement lets ICE do with your file.

Germany's court allowed the analysis on conditions: the threshold, the data list and the published rules come first — and even there, the rules have since loosened and face a pending challenge. Here the order runs the other way: a five-year ordering window is open, and whatever limits the agreement sets sit in a work statement the public hasn't seen.

What to watch: the next orders, ICE's AI and data request (responses due October 16), the pending German complaint and a House bill that hasn't moved since March. If I could ask Congress for one thing, it would be Germany's order of operations: publish the requirement, the threshold and the oversight before the next orders. As I wrote in that broker-data piece, building a dossier will keep getting cheaper. Finding out what's in the government's copy shouldn't get harder at the same time.

The paperwork says "full and open." So far, that's the most open thing about it.

The honest answer may be a person and a piece of software, taking turns. In 2024, 71 percent of hospitals reported using predictive AI built into the electronic health record (the federal count covers non-federal acute care hospitals), most commonly to predict "health trajectories or risks for inpatients," such as early detection of a condition "like sepsis." So while you slept, a model may have been scoring how worried everyone should be about you. When it flagged something, a nurse or a doctor looked at the alert, looked at you, and decided whether the machine was right.

On September 30, Governor Gavin Newsom signed AB 1979, which tells hospitals to take reasonable steps to protect that clinician's judgment whenever software informs your care. The same day, he vetoed AB 2575, which would have barred punishing a bedside worker solely for overruling the software (or for trusting it). The institution got a duty; the person at your bedside got no protection of their own. Why should you care, lying in that bed? Because whoever decides whether to believe the screen may also be weighing what disagreeing will cost them.

So what does the new law make your hospital do?

AB 1979, by Assemblymember Mia Bonta, turns on one sentence: a health facility, clinic, physician's office or group practice "shall take reasonable steps to ensure" that a licensed provider, acting within their scope of practice, "retains the ability to exercise independent professional judgment" whenever your care "is informed by the output of a clinical decision support system." That means any AI producing "a prediction, classification, recommendation, evaluation, or analysis" that helps decide the timing of your care, your diagnosis or your treatment.

The governor's office billed it as "Empowering doctors to make the final call." (Doctors, yes, but the law covers every licensed clinician, nurses included, and the California Nurses Association sponsored it.)

It also bars those institutions from using AI to "independently perform" clinical work the law reserves for licensed professionals, and exempts tools for "documentation and communication that does not involve the application of professional judgment." (Whether the AI scribes I wrote about in August qualify, the law doesn't say.) It takes effect on January 1, 2027.

So far so good. But the Senate softened it. The bill lost a requirement that "no clinical decision" rest solely on the software's output, traded "ensure" for "take reasonable steps" to ensure, and struck the enforcement provisions that ran through the unfair competition law and the Department of Public Health. What remains sends "a violation of this section by a physician" to the physicians' licensing boards, lets licensing boards seek injunctions against unlicensed practice, and preserves any remedy "otherwise authorized under the law."

I went looking for a penalty aimed at the hospital itself. The law names none; whether the state health department could still act against one on its own authority, the text doesn't say. Nor does it give the clinician a remedy of their own. After the amendments, the California Hospital Association listed the law as "Neutral as Amended."

What would the vetoed bill have added?

AB 2575, by Assemblymember Liz Ortega, was about the person rather than the building. When the AI gets it wrong, Ortega said, bedside workers face a double bind: "Follow the machine, and then they get blamed, or override the machine and then they risk retaliation."

Her answer was a shield. An employer "shall not retaliate or discriminate" against a worker providing direct patient care, using professional judgment within their scope of practice, "based solely on the worker's override of, or reliance on," the output of a clinical decision support system. Three details matter:

1. It covered trusting the software as well as overruling it, for any direct-care worker.

2. "Solely" left the employer every other reason. The duties to meet the standard of care and follow written policies stayed, and the Labor Commissioner, who would have taken workers' complaints, could weigh an alleged failure to meet them.

3. Deference would not have counted as a duty. A rule requiring staff to "accept, defer to, or refrain from overriding" the output was expressly excluded from those duties.

It also reached the courtroom. In a suit over harm from one of these systems, anyone who "developed, modified, selected, or deployed" it — the vendor, but also the hospital — could not have argued that a health worker's failure to override was "a superseding cause severing the defendant's liability" (lawyer-speak for an intervening act that breaks the chain of blame). Other defenses remained, and malpractice suits against licensed clinicians were carved out. A law signed last October already bars a defendant who developed, modified or used AI from arguing "that the artificial intelligence autonomously caused the harm." Blaming the machine is out. Pointing at the nurse who didn't overrule it is still on the table.

So why the veto?

Newsom's veto message makes two arguments. The first is that by barring adverse actions based solely on an override or reliance, the bill "ties the Labor Commissioner's hands in establishing a violation — a higher bar than other retaliation protections, which simply prohibit action because of a protected activity."

Read that twice. The hospitals argued the shield went too far; the governor's first objection is that it was too weak: "This bill's anti-retaliation provisions do not protect workers as intended."

The second is about expertise. Tying the protection to scope of practice, he writes, "puts the Labor Commissioner in the position of adjudicating the standard of care for patients — something the Labor Commissioner does not have the medical expertise or skill to do."

That objection has footing: the bill let the Commissioner weigh "evidence supporting alternate reasons" for the employer's action, including an alleged failure to meet the standard of care. But it also said it "does not require the Labor Commissioner to adjudicate or make a final determination" on that question. Can a labor official weigh medical evidence without ruling on medicine? Reasonable people can read it either way.

The nurses' union calls the result a gap: "Today, a nurse who sees that the algorithm is wrong and acts to save her patient can still be disciplined or fired by her employer," said Sandy Reding, the California Nurses Association's president. One qualification: California already bars a health facility from retaliating against a worker for presenting "a grievance, complaint, or report" to the facility, its medical staff, an accreditor or a government agency. The report is protected. The bedside decision to overrule the screen isn't, specifically.

Isn't the nurse sometimes the one who's wrong?

Yes, and the hospitals' case deserves its full weight: clinicians miss sepsis, and alerts exist to catch it. The software misses too. A University of Michigan team that tested a widely used proprietary sepsis model, then implemented at hundreds of U.S. hospitals, reported in 2021 that it alerted on "nearly 1 in 5 of all patients, with most of those patients not actually having sepsis." (Karandeep Singh, one of the researchers, added that the vendor's own analysis wasn't wrong; the model had been built to predict sepsis as clinicians recognized it, and "we know that clinicians miss sepsis.") An updated version, tested across four health systems in a study published this year, ranks risk better but still comes with "high alert burden."

The case for trusting the alert is real, too. At five hospitals using a sepsis alert developed at Johns Hopkins, sepsis patients flagged before antibiotics whose alert a provider confirmed within three hours had a reduced in-hospital mortality rate, 3.3 percentage points lower after adjustment than those whose alert wasn't confirmed in that window. That is an association from an observational study, not a randomized trial, and the alert's developers led it (its senior author is a founder of, and holds equity in, the company that sells it). A companion study found 89 percent of its alerts were evaluated by a physician or advanced practice provider, and fewer than four in ten of those were confirmed. Overriding is routine. Sometimes it is also the mistake.

That is the opposition's strongest point. Hospital systems and physician, health-plan, device and technology trade groups warned that AB 2575 gave a worker "unrestrained authority to override" the software "without review or supervision, which could lead to patient harm," while insisting that providers "do not deploy AI or related technologies to make care decisions." Technology and tort-reform groups called the liability clause "a one-directional liability exposure."

The bill's text answers part of that, since an employer could still act on a failure to meet the standard of care. The rest is a genuine choice: the alert is sometimes right and the nurse wrong, and sometimes the reverse, which is why it matters who pays for each mistake.

Brussels builds the override into the product, from 2028 (for now)

What would it look like to protect the override itself? Europe's AI Act offers one design, with an asterisk.

Start with the product. High-risk AI must be built so it can be effectively overseen by natural persons, who must be enabled, "as appropriate and proportionate," to set it aside in any particular situation "or to otherwise disregard, override or reverse the output," and to halt it with "a 'stop' button or a similar procedure."

Then the hospital. A deployer (for clinical AI, the hospital) "shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support."

Clinical software gets there through product law: AI that is, or is a safety component of, a product covered by Europe's regulation on medical devices is high-risk when that product needs a third-party conformity assessment, and the EU's medical-device and AI boards say "Most MDAI are classified as Class IIa (MDR), B (IVDR), or above," so most medical-device AI needs one. (Their guidance isn't legally binding, and software that isn't a medical device may never take this route.)

Now the asterisk — for AI in medical devices, these duties start on August 2, 2028, a year later than first planned; Europe set those fixed deadlines this summer.

And 2028 may not be the last word. The same amendments let the Commission, by August 2, 2027, limit some of the Act's product requirements, the override requirement among them, where device law already protects at least as well. A separate Commission proposal, still before Parliament with a first-reading vote penciled in for December 14, would take medical devices out of these duties, leaving AI rules to device law.

Europe also protects people who speak up. Article 87 extends the EU's Whistleblower Directive to "the protection of persons reporting such infringements" of the Act, and that directive requires member states to prohibit retaliation, including "any disciplinary measure, reprimand or other penalty." By my reading, Article 87 has applied since August 2, 2026, though the hospital duties a nurse might report won't bind medical-device AI before 2028, and might never if that proposal passes.

To be clear, Europe hasn't written the shield California just vetoed, either. The AI Act has no clause saying a nurse can't be disciplined for overriding; its "authority" duty runs to the hospital, which keeps its freedom to organize its own resources. My reading is that a hospital that punished someone for using the override would struggle to claim it had given them "authority." On paper, Europe builds the override into the product and the authority into the hospital's duties. California made protecting the clinician's judgment a hospital duty and vetoed the protection for acting on it.

Imagine the override becomes a metric

What follows is my extrapolation, not a forecast.

Imagine a unit dashboard in 2028 that charts each nurse's override rate on the sepsis score. AB 1979 says nothing about counting overrides, and the vetoed bill would have kept a rule demanding deference from counting as a duty. In a 2024 National Nurses United survey of its own members, 40 percent of nurses in facilities that use risk or outcome scores said they are unable to modify scores to reflect their clinical judgment, and Ortega says she heard that "the expectation from their bosses was to follow the output."

Imagine, next, the first trial over a missed sepsis case in which the defense argues that the night nurse's failure to override was a superseding cause. The person in that spot occupies what the researcher Madeleine Clare Elish calls a moral crumple zone: responsibility "misattributed to a human actor who had limited control" over an automated system, in an arrangement that "protects the integrity of the technological system, at the expense of the nearest human operator." (Her cases come from aviation, nuclear power and driverless cars; the bedside is my application, not hers.) Courts hadn't settled it in 2024, when two Stanford scholars found the case-law signals on AI liability "remain somewhat faint."

Labor, the hospitals and the right agree on more than you might think

The union side: "The governor knows A.I. should never replace a nurse's clinical judgment, but he vetoed the bill that would have protected us for using our judgment," Reding said, and Lorena Gonzalez, president of the co-sponsoring California Federation of Labor Unions, added, "We are committed to bringing this bill back next year."

The hospitals: the hospital association's David Simon warned of "a very chilling environment where a single error or a single bias" would outweigh a useful tool's benefits.

The doctors: the American Medical Association's AI principles say, "Where a mandated use of AI systems prevents mitigation of risk and harm, the individual or entity issuing the mandate must be assigned all applicable liability."

The nurses' professional body: the American Nurses Association, quoting the profession's ethics code, says nurses "are accountable for their practice even in instances of system or technology failure."

The center-right: "Because the clinician remains involved in the decision-making and can verify the system's outputs, these devices generally avoid the need for premarket FDA clearance," writes Scott Gottlieb, a senior fellow at the American Enterprise Institute (Health Dive lists his venture and board roles).

The libertarian right: Adam Thierer and Logan Kolas, writing for R Street and the American Consumer Institute before AB 1979 passed (and not about it), urge lawmakers to start from "the many existing laws, regulations, and court-based remedies" that already apply.

The union, the hospitals, the governor and even the case for lighter federal rules share one premise: the clinician keeps the decision. They split on who pays when the clinician and the software disagree. Elish's term names what happens when the question goes unanswered: the nearest human pays.

What does this mean for you?

• If a score or alert is shaping your care, ask what it is and which clinician is responsible for the decision. From January 1, 2027, the hospital must take reasonable steps so that clinician can use independent judgment. It is a fair question, and in a California acute care hospital you already have a right to know who is primarily responsible for coordinating your care.

• Read the fine print on messages from your care team. Since 2025, an AI-written message about your clinical information from a California practice or facility must carry a disclaimer that indicates to the patient that AI generated it, plus "clear instructions" for reaching a human, unless a licensed provider read and reviewed it first.

• Treat a health chatbot like a provider, because from 2027 California will. A business offering a "health care chatbot" to manage your information or a medical condition will be "deemed to be a provider of health care" under the state's medical-confidentiality law.

• If you work in a hospital and an algorithm's output worries you, put it in writing to the facility, the medical staff, an accreditor or a state agency. The law protects that report; no statute specifically protects the override itself. (This is not legal advice.)

• Know where complaints go. About a physician: the Medical Board of California, where complaints generally must be filed in writing and can be filed online (osteopathic physicians answer to the Osteopathic Medical Board). About a hospital or clinic: they are licensed and regulated by the California Department of Public Health, which takes complaints.

• Tell your legislators what you think of a second try. The state's lookup will find your State Senate and State Assembly members.

The lesson, as I see it

California has written down half of a sensible idea. From January, the hospital must take reasonable steps to preserve the clinician's judgment, and software may not "independently perform" the work a license exists for. That matters.

The other half, what happens to the person who uses that judgment, is back where it started. Overriding a veto takes two-thirds of the membership of each house, 27 senators and 54 Assembly members, more than the 21 and 51 votes the bill drew, and the session ends November 30. The next version goes to a new governor — Newsom terms out in January.

That version has to answer the veto's two objections: a "solely" test the governor called too high a bar, and a labor official asked to weigh the standard of care. Those read to me like drafting problems, not reasons to drop the idea.

Both sides of this fight reach for the same phrase. The governor's office says the signed law empowers doctors "to make the final call"; Ortega says "Californians want a nurse, not a robot, making the final call." My vote? Protect the call and the person making it in the same law, and write the second half so a labor official can enforce it without playing doctor.

If a nurse ever got someone you love through a long night, forward this to that nurse, with a thank-you on top.

If you live near a smokestack, that provision was written with you in mind. Congress put it plainly: "any person may commence a civil action on his own behalf" against a polluter violating the Act, after 60 days' notice, unless EPA or the state "has commenced and is diligently prosecuting" its own case. You have probably never used it. It exists for the day the regulators don't act — and the department now says it may close that door on any citizen's Clean Air Act case it chooses.

This time the people at the door are the NAACP and its Mississippi State Conference. On September 28 they told the court that the gas plant they are suing over is "far and away the largest industrial source of NOx" (nitrogen oxides, which help form smog) in the 11-county Memphis metro, and that regulators "have issued ozone action alerts for 26 days through September 2026, compared to just 10 days in all of 2025." Those are the NAACP's figures, untested in court, and ozone has many sources.

In September I wrote that the federal government had "walked into a private lawsuit between newspapers and an AI company, told the judge how the case should come out, and needed nobody's leave to do it." In Mississippi it wants inside a case so that it can end it. If you are tempted to file this under Elon Musk versus his critics, or this administration versus its opponents, hold that thought (I will give the department and xAI their own words throughout). As I put it then, "The instrument has no politics. It has an owner, and the owner changes every four or eight years." A power to end citizen suits would belong to every president who comes next.

What the neighbors are suing over

What exactly is in Southaven? The NAACP's complaint, filed April 14, 2026, targets a fleet of portable gas turbines on Stanton Road in Southaven, Mississippi, part of the Memphis metro. It calls them the Colossus Gas Plant and says the plant "supplies power to xAI's Colossus 2 data center," about a mile away. The NAACP sent a 60-day notice of intent to sue in February, as the statute requires; the Southern Environmental Law Center (SELC) and Earthjustice represent it. (The defendants are X.AI Corp. and its subsidiary MZX Tech LLC. SpaceX acquired xAI in February, and the company has since rebranded as SpaceXAI; I will stick with xAI, as the court caption does.)

The fleet grew fast. xAI brought 18 generators to the site in August 2025, Mississippi Today reported; by the NAACP's count there were 27 by December and 57 in satellite images taken on May 12, 2026. A state order signed July 30 counted 69 and barred any more after July 15. On September 22, xAI said it had "already permanently shut down nearly a dozen temporary turbines"; six days later the NAACP described a "now 59-turbine" plant. (If the numbers wobble, so does the fleet.)

Why no air permits? In July 2025, Mississippi's environmental regulator, MDEQ, told xAI the turbines were "exempt from permitting requirements" as long as they stayed mobile (on trailers) and temporary (each on site less than twelve months). In May, Mississippi Today reported that, by the agency's account, xAI was "not required to tell the agency" when it brought in more. The July 30 order goes further: MDEQ and the company agree that running the turbines without separate permits "has not violated Mississippi air permitting requirements," and the order sets a retirement schedule that runs to July 14, 2027.

The NAACP's case is that federal law required permits anyway. Its June brief says xAI has "not obtained a single air permit for these turbines" and that "only the 14 smallest are equipped with appropriate controls to reduce emission of smog-forming pollutants." One federal document complicates the state's reading: EPA's January 2026 turbine rule says a turbine "may, however, be mounted on a vehicle (or trailer) for portability and still be considered stationary." That rule sets emission standards rather than deciding who needs a permit, so it settles nothing here. It does make the NAACP's argument a serious one.

The temporary fleet is not the whole picture. MDEQ has also permitted a permanent 41-turbine plant, "the permanent power source for MZX's advanced computing facilities," which xAI says it began building in May 2026: "As permanent power generation becomes available, the temporary portable turbines will be removed." The NAACP and two local groups have appealed that permit, and the appeal is pending. So when you read that xAI's turbines are unpermitted, the precise version is this: the temporary ones have no air permits and the state says they need none; the permanent ones have a permit, and it is contested.

What does the NAACP want? A preliminary injunction (a court order, before trial, to stop the turbines) and civil penalties that the department puts at "$124,426 per day of violation," payable to the U.S. Treasury, not to the neighbors. xAI answers that such a shutdown order has, to its knowledge, "never been granted in any case since the Clean Air Act was enacted in 1970," and that without the plant's power, "Grok would largely cease to function." The same brief says the computing facilities the plant supplies also run "other frontier AI models, including Anthropic's Claude and Google's Gemini." (A disclosure: this piece was drafted with help from Anthropic's Claude.) Grok — xAI's AI model — is how national security entered an air-pollution case.

The sentence the Clean Air Act leaves out

So does the Clean Air Act let the government end a citizen's case? Start with what it says. EPA's administrator, "if not a party, may intervene as a matter of right at any time in the proceeding." Congress added "at any time in the proceeding" in 1990. The section covers notice, timing and penalties; it contains no provision for the government to dismiss a citizen's suit.

Compare the False Claims Act, which lets whistleblowers sue over fraud against the government. There, Congress wrote the power down: "The Government may dismiss the action notwithstanding the objections of the person initiating the action," provided the person gets notice and a chance at a hearing.

The department builds on a 2023 Supreme Court decision about whistleblower suits, Polansky, which held that the government may move to dismiss a False Claims Act case whenever it has intervened, and that such motions "will satisfy Rule 41 in all but the most exceptional cases." Its July brief reasons that its "express and unconditional right to intervene in this citizen suit necessarily includes the right to unilaterally dismiss the case in its entirety," after which a court "has no adjudicatory role." It has determined, it says, that "no relief sought by this civil enforcement action ... is consistent with federal policy and the public interest."

The Supreme Court has pictured an objecting government before. In Laidlaw, a 2000 Clean Water Act case, the majority wrote that if the executive branch "opposes a particular citizen suit," EPA's administrator may intervene and "bring the Government's views to the attention of the court," and that the government "retains the power to foreclose a citizen suit by undertaking its own action." Make your case to the judge, in other words, or enforce the law yourself. Ending a citizen's suit while declining to enforce is the department's reading, not the Court's.

An appeal from a ruling that was never written

How did this reach an appeals court so fast? The department first moved on June 15, asking the judge to dismiss the suit "in full with prejudice," which would bar refiling, and refiled on July 7 with EPA's administrator as the moving party. The preliminary-injunction hearing before U.S. District Judge Debra M. Brown, set for August 24, was continued "until further notice"; she held a telephone status conference that day instead.

What she said there, the public knows only from the parties' filings. By the department's account, the court "indicated it would deny the amended motion at some unspecified time in the future" and planned a preliminary-injunction hearing in October. The transcript's public-release restriction runs until November 24, 2026. On September 2 the department announced that "[b]arring a written ruling entered on or before September 10," it would "treat the absence of a written ruling as a constructive denial." No written ruling appeared. On September 18 the United States, "acting on behalf of Lee M. Zeldin as Administrator of the U.S. Environmental Protection Agency," appealed what it called the court's "August 24, 2026, constructive Order."

Three days later it asked the judge to pause everything, and that stay request is where the sentences at the top of this piece come from. Given what it calls its right to dismiss, the department wrote, "Plaintiffs have no cognizable interest in these proceedings moving forward." It added that "The public interest is best served if the United States can continue to achieve results like Operation Epic Fury," and asked for a written order by September 28. As of October 9, 2026, the public docket showed none: no ruling on the stay, no new hearing date, no written order on intervention.

xAI backed the stay, warning of "catastrophic financial, operational, and business harms." The NAACP opposed it, calling the notice of appeal "a procedural misadventure" and arguing that "the United States has nothing to appeal and the Fifth Circuit has nothing to review." The appeal, No. 26-60806, is now pending in the Fifth Circuit; the record on appeal is due October 19.

"Targeting facility": read the brackets

Why would an air-pollution case come wrapped in national security? Because of a sworn declaration from the Pentagon's top AI official. As the department's July brief tells it, Grok's availability "is a matter of paramount national security," and during Operation Epic Fury (the U.S.-Israeli strikes on Iran that began February 28, 2026), Grok, "through the Department's Maven Smart Systems," "enabled U.S. forces to deploy over 2,000 munitions to 2,000 distinct targets within 96 hours."

("Department of War" is a secondary title the president authorized in September 2025; statutory references to the Department of Defense "shall remain controlling." I use it only when quoting.)

Read the declaration's own sentence, though, and its subject is different. AFP, working from the scanned document, gives that subject as "[t]he project's Maven Smart Systems (MSS)," and the department's own July brief, quoting the same sentence, shows that it ends by calling the result "a testament to the greatly increased operational efficiency made possible by the Grok Gov Model." The sentence credits the model; it never says where the model ran. Then look at how the department quoted that sentence in its September stay brief. The subject becomes a bracketed insertion, "[Department of War, the Grok Gov Model AI services from this facility]," followed by the declaration's words: "enabled U.S. forces to deploy over 2,000 munitions to 2,000 distinct targets within 96 hours during Operation Epic Fury." In legal writing, square brackets mark words the person quoting has supplied. The words that tie those strikes to this facility are the department's.

Its description of the place has shifted, too. In June, the department's press release described "an AI data facility which trains and develops new AI models that are critical to the economy and the Department of War." By September it was "an advanced Department of War targeting facility." The NAACP adds that Grok's government work "began before the Southaven Colossus Gas Plant was constructed," and says xAI rents spare capacity at data centers the turbines don't power "to competitors for more than a billion dollars a month."

None of this shows the declaration is false; no court has tested it, in either direction. What it shows is narrower and more important: the link between those strikes and this facility rests on words the department supplied.

Could the department be right?

The department's position has serious company, and you deserve to hear it at full strength.

The argument runs like this. Article II gives the president the executive power, and enforcing federal law against private parties is executive power. In June, in a case about removing a federal trade commissioner, the Supreme Court said that when an agency executes a congressional mandate against private parties, "it exercises executive power—no ifs, ands, or quasis about it." That case did not involve citizen suits, but the logic travels. Nicholas Almendares, a law professor at Indiana University, argues that "you can't really have complete presidential control over enforcement without also disallowing citizen suits," and that the department "is just trodding the pathway the Supreme Court has laid out for it." (He dislikes where the path leads; his point is that the Court drew it.)

Justices have signaled doubts before. In the 2023 whistleblower case, Justice Kavanaugh, joined by Justice Barrett, agreed with Justice Thomas that there are "substantial arguments that the qui tam device is inconsistent with Article II" (qui tam is the whistleblower suit's legal name). In Laidlaw, Justice Scalia, joined by Justice Thomas, called a penalty-seeking plaintiff "a self-appointed mini-EPA." Even the Court's friendlier language cuts both ways: in 1987 it suggested that the citizen suit is "meant to supplement rather than to supplant governmental action," a line the department now quotes against this suit, while the NAACP leans on the same opinion's point that citizen suits exist for when the government "cannot or will not command compliance."

Then there is Mississippi. Its regulator decided the state's own rules exempted these turbines, and the state told the court the requested relief "would usurp Mississippi's authority." xAI says there is "a retirement schedule in place for every single one of the temporary turbines." And to be fair to xAI, the region's ozone trouble predates the turbines: the American Lung Association's 2026 report, grading 2022–2024 data, ranked the Memphis metro "27th worst in the nation for ozone pollution."

So where does the argument slip? Choosing not to enforce a law is one thing; deciding that no one may hold a company to it is another. Even Greenberg Traurig, a corporate law firm, wrote that the department's position "appears to blur an important distinction between enforcement discretion and a decision not to require compliance in the first instance." The department already has a lawful way to take over a case it dislikes: bring its own enforcement action, which can foreclose the citizen's. Instead it declares that no relief serves the public interest, while its own brief concedes that "Congress has the power to authorize private parties who have suffered Article III injury to sue to enforce certain federal statutes." The NAACP says its members are just such injured parties.

A retired scientist, a county away

What would this dispute look like in a country that has written the public's right to challenge into a treaty? Ireland is a useful test, because it has Mississippi's problem in concentrated form: its energy regulator says data centers went from "5% of national electricity demand in 2015 to 22% in 2024."

Ireland is one of 48 parties to the Aarhus Convention, the 1998 treaty on public participation and access to justice in environmental matters; the list includes the European Union, all 27 of its member states and the United Kingdom. Ireland ratified in 2012. The United States never joined. Article 9 commits each party to ensure that members of the public, "where they meet the criteria, if any, laid down in its national law," can "challenge acts and omissions by private persons and public authorities which contravene provisions of its national law relating to the environment," through procedures that provide "adequate and effective remedies" and are "fair, equitable, timely and not prohibitively expensive." Each country sets its own rules on who may bring a case (that is what "criteria, if any" means), but the floor is a promise of access.

What does that look like on the ground? In September, An Coimisiún Pleanála, Ireland's national planning body for appeals, refused permission for a data center in County Mayo that the county council had approved: a project 1.8 kilometers south of Killala that would have drawn 50 megawatts on average. The appeal came from a retired scientist, Colin Doyle, from Ennis in County Clare, another county altogether. The developer, which intended its own backup generators "using fossil gas and/or biodiesel," had not shown "a fixed connection agreement to the electricity grid," the board found, and had "failed to demonstrate that the proposed development would be in accordance with the overarching objectives of the Climate Action Plan 2025." The grounds were the grid and the climate plan, not air pollution.

Not everyone in Mayo was pleased: a local council member, Jarlath Munnelly, said the plan had drawn "no local objections," though the novelist Sally Rooney, a Mayo resident, "was among those who had objected to planning permission." The ruling "can be challenged only by way of a judicial review, which must be made within eight weeks of the decision being formally published"; none had been reported as of early October.

Here is where things get interesting. Ireland's answer to the power crunch resembles what xAI did in Southaven. Under a December 2025 decision, the regulator requires new large data centers to provide "dispatchable onsite or proximate generation and/or storage capacity which matches their MIC" (their maximum draw from the grid) and to meet "at least 80% of their annual demand with additional renewable electricity projects generating in the Republic of Ireland." Environmental lawyers were "given the go-ahead by the High Court to challenge" the rules in April; the groups bringing the case say the rules breach Ireland's climate law by locking in long-term dependence on fossil fuels, and it is pending. Ireland is nudging data centers to bring their own power — and the public can take that policy to a judge.

To be clear, Ireland is not a paradise of open courtrooms. Since May 18, 2026, a new fee scale has capped the legal costs recoverable in successful environmental cases; before, "a public body was liable for the legal costs of a successful applicant." The government insists the caps "do not limit access to justice or constrain the right of individuals or communities to challenge decisions, which remains a central part of our planning process." An Taisce and Friends of the Irish Environment are challenging them; their case was listed before the High Court for directions in October, and no outcome had been reported as of October 9. The Irish Times editorial board split the difference: the caps will "discourage environmental activists and others from taking judicial reviews," yet the case for "putting some limits on the ability of people to object to these projects is a strong one." And access is not victory: in Ennis, challengers to another data center lost in the High Court, where a judge called their climate argument "inherently implausible."

So compare. In Ireland the argument is over how hard and how expensive it should be for a member of the public to challenge a data center and its power supply, and even a government capping what winning challengers can recover calls the right central. In the United States, the Justice Department argues it can end a citizen's Clean Air Act case outright. One country is haggling over the price of the courthouse door. The other is arguing over who holds the key.

Imagine the next plant

What follows is my extrapolation, not a forecast, and no court has adopted the department's theory. But every piece of it is already on paper somewhere.

Imagine it is 2029 and the theory has won in a court that matters. The department's brief notes that other environmental citizen-suit provisions (the Clean Water Act's among them) are "similar to the Clean Air Act's provisions." Steve Vladeck, a legal scholar who discloses that he sits on the board of Earthjustice (co-counsel for the plaintiffs), warned in June that the theory, "taken to its logical limits," would let the executive "shut down any citizen suit under any environmental statute, against any defendant, whenever the government decides that non-enforcement better serves its policy goals." So when neighbors file, a company's first call goes to Washington — well before it goes to its engineers.

Imagine the permit question simply going away. Axios reported in September that EPA is "considering a rule that could treat some temporary gas turbines as mobile equipment," according to the Natural Resources Defense Council's John Walke (no such proposal had appeared in the Federal Register as of October 9). EPA has also proposed letting builders start non-emitting construction "before an owner or operator obtains an NSR air permit" and letting states decide "whether, when, and to what extent public participation" happens on smaller permits. Neither is final. Stack them, and the next data center's power plant might never need the permit the NAACP sued over.

Imagine the national-security umbrella opening wider. In 2025 the Pentagon's AI office signed frontier-AI contracts with xAI, OpenAI, Anthropic and Google, "each worth up to $200 million." In the stay brief, the Pentagon "relies on xAI as a primary classified computer infrastructure provider." Any of those companies' data centers could be described the same way in a future brief. (A possibility, not a prediction; the template now exists.)

And imagine neighbors bought out before they reach a courtroom. In Southaven, MZX Tech is offering to buy homes near the plant, and owners who accept "would give up the right to take part in a class action lawsuit over the noise," DeSoto County News reported (that is a separate class action over the noise, not the NAACP's case). Southaven's mayor calls the offers "all voluntary" and says the company has "not broken any federal, state, or local law." Picture that waiver as standard in every siting deal, and any Clean Air Act suit that remains subject to an executive veto.

Who else is worried, and who isn't

Who else sees it this way? The answer does not sort neatly by party.

The case against citizen suits has a long pedigree on the right. The Pacific Legal Foundation, a libertarian law firm, says the Clean Water Act's citizen-suit provision "wrongfully gives unchecked power to anyone who wants to wield it." A commentary in American Thinker puts the democratic objection bluntly: "Private advocacy groups cannot be voted out of office." And the department's June press release quoted Associate Attorney General Stanley Woodward: "Ultimate responsibility for enforcing federal law belongs to the Executive Branch, not private interest groups."

Some of the sharpest objections come from people who grant that debate is real. The UnPopulist, a liberal anti-authoritarian publication, grants that conservative and libertarian doubts are "a legitimate debate for Congress and the courts," and still calls the department's ask "a standing executive veto over lawsuits Congress expressly authorized." Greenberg Traurig suggests that "A narrow statutory ruling may be more likely than a sweeping constitutional decision." Vladeck says the motion "turns on a dangerous new constitutional claim" and that the analogy to the whistleblower case "collapses on a single structural difference": the NAACP "filed in its own name, asserted its members' own injuries."

The academics are pointed, too. Erika Kranz of Harvard's Environmental & Energy Law Program calls it "the first time the United States has intervened in a citizen suit against a private defendant and argued that the suit must be dismissed," and notes that "no court has adopted the central argument the government makes here" (still true on the public docket as of October 9). Deborah Sivas of Stanford warns that, if courts accept it, it "could significantly weaken citizen suits as a backstop when government regulators choose not to act." Sarah J. Morath of Wake Forest counts citizen-suit provisions "used in over 2,000 lawsuits" since the 1970s. And three scholars in the California Law Review argue that the history runs the other way: "Founding Era lawmakers passed reams of statutes empowering private plaintiffs to sue for wrongs done to society."

On the left, Balls & Strikes sets the two statutes side by side and concludes, "The Clean Air Act has no such provision." A consumer-law blog hosted by Public Citizen worries that if the theory spread to consumer law, "favored businesses could violate federal consumer protection laws with impunity," while hoping "Vladeck's fears are overblown." For the plaintiffs, Earthjustice's Laura Thoms says, "There is no moral or legal precedent for this," and the NAACP's Abre' Conner puts the stakes in one line: "A data center should not be a potential death sentence for a community's health."

Strip away the heat and there is more agreement than you might expect. The department concedes that Congress may let injured people sue. The NAACP concedes the government can likely take part in the case in some form. The fight is over who decides whether a citizen's case goes forward: the court, or the executive.

What does this mean for you?

• Look up what is near you. EPA's Enforcement and Compliance History Online lets you "search for facilities in your community to assess their compliance with environmental regulations."

• Report what you see. EPA's site lets you "report suspected environmental violations." A report is not a lawsuit, but it costs nothing.

• Know your rights as they stand today. Any person may sue a violator after 60 days' notice to EPA, the state and the company, unless the government is already "diligently prosecuting" its own case. As of October 9, 2026, that is still the law; no court has accepted the department's theory.

• Comment on permits, and keep a copy. If a major plant near you needs an operating permit, anyone can later petition EPA to object, but only on concerns "raised to the permitting authority during the notice and comment period." Skip the comment window and you may lose the argument. From October 26, 2026, an EPA rule limits when those petitions can revisit a plant's preconstruction permit (its permit to build) if that permit was issued with public comment and a chance at court review, so raise those concerns when it is proposed. EPA's proposal to let states decide how much the public takes part in smaller permits is not final; watch your state's rules, and the Federal Register for any proposal to treat portable turbines as nonroad engines (none had been published as of October 9).

• Get the ozone alerts. Find out who issues them where you live. Near Southaven, Mississippi publishes daily ozone forecasts for DeSoto County from April to October, the Shelby County Health Department issues a "Code Orange Air Quality Forecast Advisory" for the Memphis metro, and on an Air Quality Action Day sensitive groups are asked to limit exertion outdoors.

• Follow the case yourself, for free. The public docket linked above carries the filings (NAACP v. X.AI Corp., No. 3:26-cv-00074, Northern District of Mississippi).

• Read the fine print on any buyout. Southaven owners who accept MZX Tech's offers give up the right to join the noise class action. Before you sign anything like it, ask a lawyer what you are giving away.

• Ask your members of Congress one question. Should the Clean Air Act say, in plain words, whether the government may dismiss a citizen's suit? The False Claims Act does. Whatever answer you prefer, it belongs in a statute, not a brief, though if the department's Article II argument wins, even a statute may not settle the matter (Almendares, for one, is "pessimistic that any amendments to the Clean Air Act or similar statutes would make a fundamental difference").

The lesson, as I see it

Reduce this case to its frame and it is about a door. Congress cut one into the Clean Air Act so that people who breathe the air could walk through it when those paid to enforce the law would not. The department says it holds a key, and may lock that door on any case it chooses.

The courts may agree; the Supreme Court's recent reasoning gives the argument a path. But consider what changes if they do. A citizen suit would survive only when the government of the day does not object, which means only in the cases the government never minded in the first place. And time matters even if the department loses: every month without a hearing is a month the remaining temporary turbines keep running toward a retirement date already set for mid-2027. As I wrote in September about a very different fight, a right you cannot enforce in time is "not much of a right."

What should you watch? A ruling on the stay, which could come any day; October 19, when the Fifth Circuit's record is due; and November 24, when the transcript restriction ends and you should be able to read what the judge said in her own words. And watch Ireland, where a retired scientist from one county stopped a data center in another, at least for now.

My vote? Keep the door open, argue as hard as you like about who may walk through it and at what cost, the way the Irish do, and let Congress, not a brief, decide whether anyone gets to lock it.

For now, the right the Clean Air Act gives "any person" still belongs to you. The HAIA Foundation keeps watch on how AI's hunger for power reshapes rights like that one; subscribe and follow the case with us.

Social Security's own rulebook has a worked example of how that can go wrong. You are 60 and widowed, and you ask your Social Security office about widow's benefits. The employee you reach says you must be 62. That is wrong, and because of it you don't apply.

What happens when you find out? Here the law has an answer: because the bad information came from a Social Security employee, Congress lets the agency treat you as having applied when you were misinformed (if you can prove it to the agency's satisfaction, which is harder than it sounds).

Now ask somewhere new. On September 29, 2026, President Trump signed an executive order creating America.gov, a federal website built around an AI chatbot, which went live that day. The order says it will be a place where you can "receive accurate answers."

What happens if one of those answers is wrong? As I read the law, the answer is the one the Supreme Court gave a former Navy welder in 1990.

A front door, a promise and a sentence most orders carry

So what does the order actually do?

Executive Order 14432, published in the Federal Register on October 2, 2026, names America.gov the "unified digital front door" to the federal government. The General Services Administration must "establish and operate America.gov," working with the White House's National Design Studio, and GSA says the site draws on "more than 29,000 government websites." Among its stated policies: "ensure that super intelligence used in connection with America.gov is accurate, reliable, and transparent." (Super intelligence is now the executive branch's official term for AI, under a second order signed the same day.)

At launch, the site answered questions. The White House says you can already "get an up-to-date answer," with passport renewal and Medicare enrollment to follow later in 2026. The next phase, which GovExec reports is "set for early 2027," would let you apply for benefits such as Social Security inside the chat. The order gives the Office of Management and Budget 90 days, until December 28, 2026, to tell agencies how to plug in; as of October 3, 2026, OMB's list of memoranda showed nothing on America.gov.

"So there's no chance of getting outdated or inaccurate information like you might on third-party websites," Joe Gebbia, the U.S. Chief Design Officer, told CNBC.

Its closing section holds a sentence that can sound like a trapdoor: the order does not "create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States." The renaming order signed beside it carries the same sentence, word for word, and a Yale Law Journal note describes it as the disclaimer "the typical modern executive order" makes. It is boilerplate. Delete it and, as I read the law, your position would be the same, because the rule that decides what happens when a government answer is wrong comes from the Supreme Court.

The welder, the out-of-date form and the rule that still decides

Why should a 1990 case about a welder decide anything about a chatbot? Because it answered the same question, about a government form.

Richmond had been a welder at the Navy Public Works Center in San Diego. Relying on a government form (and on oral advice a dissenting justice called "similarly erroneous"), he earned more than the statute permitted and "lost six months of benefits." The form, the Court said, "was correct when written in 1981; but when given to respondent, the form was out of date and therefore inaccurate." Set that beside Gebbia's "no chance of getting outdated or inaccurate information": thirty-six years apart, the same risk.

The Court ruled against him anyway. "We hold," Justice Kennedy wrote for the majority in Office of Personnel Management v. Richmond, "that payments of money from the Federal Treasury are limited to those authorized by statute," because "Money may be paid out only through an appropriation made by law." The Court left open "whether an estoppel claim could ever succeed against the Government" (estoppel means holding a party to what it told you, once you relied on it), but for money the answer was no: a wrong answer cannot make the Treasury pay a benefit the law doesn't allow.

The opinion also says where the fix belongs: "Congress may always exercise its power to expand recoveries for those who rely on mistaken advice." For Social Security, Congress has, narrowly. If the agency is satisfied that you "failed as of any date to apply" because of misinformation from "any officer or employee of the Social Security Administration," you are treated as having applied when you were misinformed (or when you first qualified, if that came later). That is the whole remedy: an earlier filing date, for people who didn't apply.

The agency's regulation narrows it further. The misinformation must come from "one of our employees while he or she was acting in his or her official capacity as our employee," and the agency "will not find that we gave you misinformation, however, based solely on your statements." Among the things it says do not count as proof: "Information provided by other governmental agencies."

America.gov is operated by GSA, not Social Security. So, as I read these rules, its chatbot's answers fall outside them: they come from no Social Security officer or employee, and they are information from another agency. That is my reading, not a holding; I know of no court that has ruled on a chatbot's answer under any of this. I would not want to be the widow who tests it.

Isn't some advice better than none?

The Supreme Court thought so, and the argument deserves a fair hearing. "A rule of estoppel might create not more reliable advice, but less advice," Justice Kennedy wrote, and the loss would fall hardest "on those of limited means, who can least afford the alternative of private advice." It still bites — a chatbot whose every sentence could bind the Treasury is a chatbot no agency lawyer would let anyone switch on.

The administration's case is strong, too. "Americans spend around 10 billion hours each year dealing with federal paperwork," says the White House's fact sheet, and the president promised "one front door for every single question" without bricking up the old ones — the order keeps phone, mail and in-person service. The site says it "never includes ads, and keeps your privacy protected," and its privacy page, GovExec reported, says it doesn't save conversations. And according to the New York Post, it warns users that "AI can make mistakes" and tells them to "check the sources included with each answer before making an important decision."

So far so good. Then what's wrong with the bargain?

When CBS News's medical correspondent, Dr. Céline Gounder, tested it at launch (the answers may have changed since), it handled emergencies well: chest pain and a numb left arm drew "Call 9-1-1 now." On insulin, it said "most Part D plans cap insulin at $35 for a month's supply (participating plans; check your formulary)." "Participating plans" belongs to a voluntary 2021 pilot; a 2022 law extended the cap to every Part D plan, and Medicare's own page says "the $35 limit applies to everyone who takes insulin." The chatbot, she wrote, "described the pilot and left out the law that replaced it." It was Richmond's out-of-date form — reissued by a machine.

And the answers move. While the president was still speaking at the launch, the Associated Press reported, "the site began modifying its answers"; a White House official's response to CBS was that America.gov "will continue to be updated." An answer that can change within hours is one you will struggle to prove you were given.

Two justices dissented in Richmond. "In this case," Justice Marshall wrote, "we must decide who should bear the burden of the Government's error." The majority's answer was the claimant, unless Congress provides otherwise.

What would a slower launch have looked like?

Britain has run one. Its Government Digital Service tested a first version of GOV.UK Chat, an AI assistant for the government's main website, in 2023, and said publicly the next year that its answers "did not reach the highest level of accuracy demanded for a site like GOV.UK."

Then came two public pilots over 18 months, more than 10,000 users and a published scorecard: accuracy up "from 76%, our earliest benchmark, to our latest figure of 90% accuracy across all topics." To be clear, that is GDS's own score on its own benchmark, not an independent audit.

Chat appeared in the government's app on March 26, 2026, "without any proactive communications," and only on May 14 did GDS start "officially launching GOV.UK Chat," as an opt-in feature for app users signed in with GOV.UK One Login, after what PublicTechnology called "two and a half years of development and trials."

London promised "instant, clear and reliable answers" too, and kept its helplines open. What came with the promise was the fine print. The app's terms call Chat "experimental" and "voluntary," and say it outright: "You are responsible for checking the accuracy of GOV.UK Chat's answers. You must verify any information provided in GOV.UK Chat responses before taking any action or otherwise relying on the information." Its designers set out to "be upfront about the small, unavoidable risk of inaccuracy with AI tools." Compare that with "no chance."

It still made mistakes. Ian Murray, then the minister for digital government, told The Times the bot had been "tested to essentially destruction," LBC reported on May 15, 2026. Yet in questions The Times published, the tax expert Dan Neidle of Tax Policy Associates had asked whether a £1,000 raise from £99,000 would affect tax-free childcare, and was told "the scheme does not have an upper income limit," missing the well-known £100,000 cliff edge. The Chartered Institute of Taxation tells its members to treat Chat as "a signposting and research tool."

So the difference isn't the fine print. Britain doesn't let you rely on its chatbot either; its terms say so, and America.gov's own warning tells you to check the sources. The difference is process: years of testing, a published score and an opt-in launch inside an app, against a site launched the day its order was signed with a promise of "accurate answers." As of October 3, 2026, I could not find a published accuracy figure or test results for America.gov in the order, the fact sheet or GSA's release. GSA says it built the platform "in record time"; the president says the project began "almost on day one" of his administration. What's missing is the published evidence.

When the chatbot starts filling in your forms

"Very soon, all she'll have to do is ask America.gov and it'll fill out the forms, track the progress," the president said of a newlywed changing her name, according to Fox News.

So imagine it is 2028 (this part is my extrapolation, not anyone's plan). You are 60 and widowed, and you ask America.gov whether you can claim. It tells you to wait until 62 and offers to start the paperwork then. Why wouldn't you believe it? The order behind it promised accurate answers. Two years later, someone at a Social Security office tells you otherwise.

Whose mistake is that? The order keeps each agency's "adjudicatory authority," so Social Security decides your claim — but its misinformation rule covers its own officers and employees, and the chatbot is GSA's. You would need proof, and the privacy design that keeps your conversation from being saved (a real virtue) also means there may be no record unless you kept one. Once the chatbot is filling in Social Security's own forms, would a court treat its answers as Social Security's? I don't think anyone can know yet. The order says nothing about relying on an answer at all.

What the builders, the skeptics and the scholars say

The people running America.gov call it a beginning. "People need to start with something simple to gain confidence and familiarity with it," GSA's administrator, Ed Forst, said, according to the New York Post. "Quite frankly, you don't jump to the end game past that." On the free-market right, R Street's Spence Purnell and Adam Thierer, opposing the FTC's proposed accuracy policy for private AI companies in July 2026, noted that most large language models "already have disclosure statements." By that logic, America.gov's warning does its job.

On the center-left, Brookings' Nicol Turner Lee told Newsweek that using AI "in theory, could help alleviate some of that burden," but that "users will need accountability when something goes wrong." Code for America's chief executive, Amanda Renteria, backed the goal but told FedScoop that "the measure of success isn't whether government has adopted a new technology."

The scholars got here first. In 2022 the Administrative Conference of the United States (ACUS), a federal agency that advises other agencies, noted that "Agencies generally take the position that users cannot rely on automated legal guidance." In a report for ACUS, the law professors Joshua Blank and Leigh Osofsky found that officials "all agreed that, as a matter of law, users could not, in fact, rely upon such tools," and one agency stressed that its tool could not give a wrong answer "because all the answers had been internally vetted." (Sound familiar?)

What does this mean for you?

Use America.gov to find the right door. Just don't mistake it for the person behind the door.

• Treat every answer as a pointer, not a ruling. The site itself says "AI can make mistakes," and the agency that runs your program, not the chatbot, decides your claim.

• Click through before you act. The site tells you to "check the sources included with each answer before making an important decision." Gounder's advice: "Use it to find forms and deadlines."

• Screenshot the question and the answer, with the date and time showing. The site says it doesn't save conversations, and answers change. A screenshot guarantees nothing (Social Security won't find misinformation "based solely on your statements," and, as I read its rules, a chatbot's answer may not count at all), but it may be the only record you have.

• For anything touching money or eligibility, ask the agency. The order keeps in-person, phone and mail service, so that America.gov "does not become the only option." For Social Security, that means the toll-free line, 1-800-772-1213, or your local office, in person or by mail. As I reported on September 30, the average wait on Social Security's national 800 number has fallen from 34 minutes to 0.6 minutes, though Representative Judy Chu, pointing to how phone waits are counted, called some of the agency's statistics "extremely misleading."

• For Social Security, get it in writing. The "preferred evidence" in its misinformation rule includes "A notice, letter or other document which was issued by us and addressed to you" and "Our record of your telephone call, letter or in-person contact." When you call, note the date, the time and who you spoke with. It is the habit I urged in August for anyone denied credit: get it in writing, and note the date.

• If anyone says you don't qualify, protect your date anyway. Social Security will use the filing date of "a written statement, such as a letter," showing you intend to claim, if you meet the rule's conditions, including filing the application within six months of the agency's notice. By mail, the postmark can count when the date of receipt would mean losing or lessening your rights. And filing an application is what gets you "a written notice of our initial determination," with the reasons and your right to reconsideration.

The lesson, as I see it

The order's promise of "accurate answers" is a fine one. But a promise with no remedy behind it works like a slogan — and the remedy isn't the order's to give. It lives in a 1990 Supreme Court rule and a Social Security statute written for the agency's own officers and employees, and as I read both, a wrong answer from the government's chatbot falls between them.

In July I wrote that "a machine that cons you is a machine that should answer for it." America.gov isn't conning anyone; a stale insulin answer is an honest mistake. But the question is still Justice Marshall's: who should bear the burden of the government's error? As the law stands, as I read it, you do.

The fixes are within reach. OMB, whose implementation memo the order requires by December 28, 2026, could adopt what ACUS recommended in 2022: let users "obtain a written record of their communication with automated legal guidance tools," with "date and time stamps," and keep a public archive of every update. The administration could publish an accuracy benchmark, as Britain did. And Congress, which the Court said "may always" expand recoveries for people who rely on mistaken advice, could extend Social Security's misinformation rule to the government's own chatbot. (It would not take a long bill.)

My vote? Use the front door. Keep the receipt. And until the law catches up with the promise, check the answer with the agency that decides.

If you handle a parent's Social Security, Medicare or VA paperwork, or know who does, send this along before the chatbot becomes the first call.

Think of the last meeting you sat through and then read an AI recap of, or the last long email thread you caught up on through its summary. Pick one small detail: who raised the objection, which deadline was agreed, whether the figure was twelve or twenty. Got it? Now the harder question. Are you remembering the meeting, or the recap?

If you can't say for sure, you've just met the problem this piece is about. You have probably assumed that if the summary had gotten that detail wrong, you would have caught it. You were there, after all.

That assumption carries a lot of weight now. Six in ten U.S. adults say they read AI search engine summaries, the Pew Research Center reported in June, and summaries have spread, in Georgetown University's words, "from news article previews to workplace meeting transcriptions" to police body-camera footage. Wherever they go, the deal is the same — the machine drafts, a person checks. In September, writing about California's law on AI-drafted police reports, I argued that when even veteran supervisors can't spot the machine, "the honor system was never a system."

A new study from Georgetown and the University of Washington puts the deal itself to the test. Humans in the loop "are often expected to correct for AI's mistakes," the authors write, yet "our work suggests human memory can instead be distorted by these mistakes."

A 25-second crash, two road signs and one swapped sentence

So what did the researchers do? (Bear with the details; they decide what the result can mean.)

Mattea Sim and Tadayoshi Kohno of Georgetown and Yael Eiger of the University of Washington recruited U.S. adults online. Each watched a 25-second animated clip built in Grand Theft Auto V: a red car approaches an intersection with either a stop sign or a yield sign and hits a pedestrian. Then came a 24–48 hour gap — chosen because misleading information does more damage once the original memory has had time to fade.

Back for part two, they read a 21-sentence summary of the clip, one sentence per page, credited either to AI software or to "a person who works as a professional video transcriber." Everyone got the same ChatGPT-written text except one sentence the researchers controlled: the sign either matched what they had seen or was swapped, in ChatGPT's own wording. Then, told to think back to the video rather than the summary, they answered twelve two-choice questions. The one that counted: at which sign had the car stopped? Stop, or yield?

Among the 328 people analyzed, 83.6 percent of those who had read the accurate summary got the sign right, "compared to only 44.8%" of those who had read the misleading one.

Two cautions. These are two groups compared side by side, not one group getting worse. And with two choices, a blind guess is right half the time, so the misled group did no better on that detail than a coin toss would have.

It was only that detail, though. On average, participants got 91.4 percent of the other eleven questions right. They remembered the video; the detail that gave way was the one the summary changed.

Here is where things get interesting: did being told it was AI help? Not measurably. Among those misled, 46.3 percent of people told the summary came from AI got the sign right, against 43.4 percent of those told a person wrote it — a gap the authors found was not significant. Trust in AI and how much people used it didn't change their susceptibility either; the authors treat that "with caution," but suggest that "increasing AI literacy alone may not be enough."

None of this is new psychology. The design echoes a 1978 experiment by Elizabeth Loftus and colleagues, and people in such studies have long been "misled into remembering a yield sign as a stop sign." What's new is a machine as the source.

And how often does AI get a summary wrong on its own? In a separate check, two popular consumer models, ChatGPT-5.5 and Gemini 2.5 Flash-Lite, summarized each video five times in spring 2026, told to "Make sure everything important is included in the summary." All twenty summaries included mistakes, at least seven apiece. Most often they left things out — 51.6 percent of central details on average — and nineteen of twenty omitted "the single most central detail of the event: the car colliding with the pedestrian." (Ten summaries per model is a small sample, as the authors acknowledge, and no basis for ranking the two.)

The full paper is a preprint; a shortened version appears in the proceedings of a peer-reviewed AI ethics conference meeting in Malmö, Sweden, October 12–14.

Doesn't the officer have the footage?

It's the strongest objection. The participants weren't proofreading; they read the summary one sentence at a time and only later answered from memory. An officer using Axon's Draft One gets the opposite instruction, in the product page's words: "Review your draft alongside the original footage and transcript." And drafts arrive within five minutes of an incident ending, by Axon's account, not a day or two later.

The authors are candid about other limits. The crash was an animation ("We did not use actual police body cam footage," Kohno said). The summaries came from consumer chatbots working from video, while Draft One drafts, Axon told GeekWire in 2024, "strictly from the audio transcript" of the body-camera recording (the authors' untested hypothesis: audio-only summaries "could be less accurate"). The memory-test summary was re-prompted until it included the accident, then picked from among the better outputs. And human reports were never a gold standard; the Council on Criminal Justice's nonpartisan AI task force notes that ordinary practice already includes "an under-measured baseline error rate."

So where does the objection run out?

First, review on paper isn't always review in practice: in records Mother Jones obtained in 2025, six of the seven departments that responded had "turned off features that required officers to review AI-generated reports."

Second, rewatching the footage catches a wrong sentence only if something prompts you to look. The commonest error in the study was omission, and a missing sentence doesn't look wrong.

Third, noticing isn't immunity. Spotting a discrepancy can reduce the effect, the authors note, but Loftus has written that "false memories can still occur even if a discrepancy is noticed," and sketched what the rememberer sometimes thinks: "Gee, I thought I saw a stop sign, but the new information mentions a yield sign, I guess I must be wrong and it was a yield sign."

And the report outlives the review. "When cases take months or years to reach trial, officers often depend on their reports to refresh their memory about key details," notes Fair and Just Prosecution, a network of reform-minded prosecutors.

In King County, prosecutors refused the draft itself

Is a signature enough? One prosecutor's office said no, two years before this study.

In September 2024, the King County Prosecuting Attorney's Office in Seattle told local police chiefs that it "will not accept any police report narratives that have been produced with the assistance of AI. All reports must be produced entirely by the authoring officer." (Departments had asked about Axon's Draft One and other tools, ChatGPT among them.) The memo's reasoning reads like this study's premise in a practitioner's words: "While an officer is required to edit the narrative and assert under penalty of perjury that it is accurate, some of the errors are so small that they will be missed in review." Its example was an otherwise excellent report that mentioned "an officer who was not even at the scene."

The memo insisted, "We do not fear advances in technology," and Axon replied at the time that "critical safeguards require every report to be edited, reviewed and approved by a human officer" — the very safeguard the memo doubted. Fair and Just Prosecution calls King County "the first prosecutorial office in the country to publicly announce" such a refusal. It's an office policy, not a law, and could change without a vote; on September 17, 2026, a Scripps News report still listed King County among the places where "prosecutors have hit the brakes."

The states known to have legislated took the other road. At least two states, California and Utah, have passed laws on AI-written police reports, and both chose a label and a signature. California requires a statement, on each page or within the body of the text, that AI helped write the report, plus the officer's signature verifying that "the facts contained in the official report are true and correct." Utah requires a disclaimer and, in the Electronic Frontier Foundation's summary, requires officers to certify that they checked the report for accuracy. R Street's Logan Seacrest, on the free-market right, gave both states credit: "One thing Utah and California both get right is keeping a human in the loop."

Even Washington's own AI Task Force recommended "officer attestation of completed review" for AI-written reports, though the Legislature enacted that recommendation only "in part" — and the part was about license-plate readers. A Justice Department community-policing newsletter summed up the standard arrangement in January 2025: a disclosure, and "the officer's signature testifies to the accuracy of the document." Truleo's chief executive describes the same sign-off for its own tool.

In 2026, the refusal side grew. In April, Connecticut's chief state's attorney, Patrick Griffin, backed by the state's police chiefs and State Police, imposed a statewide moratorium on AI programs "to draft, author and/or narrate criminal reports" while the software is tested and rules are written. Under present technology, he said, officers would be "essentially swearing under oath to what a computer believes it heard." The moratorium mooted a public defenders' proposal for a label and a signature. And in mid-September, Wayne County, Michigan's prosecutor, Kym Worthy, stopped short of refusal but urged departments "to be cautious and restrained" while she writes a countywide policy.

So which side does the study favor? To be clear, it backs King County's worry without proving King County's remedy. It shows that a reader's memory can absorb an error in a summary; it doesn't show how often police software makes such errors, or that refusing the draft beats labeling it. What it changes is what a signature can mean. A California officer signs that the facts are "true and correct." After a fluent draft, some of what feels true may have come from the draft.

Imagine the summary as the only version anyone reads

What follows is my extrapolation, not the study's. Every piece of it is already for sale, on someone's agenda or in a lab.

Imagine the review screen of 2029. The draft arrives with a planted mistake to prove someone read it (Draft One can already insert a suspect "absolved by presenting a convincing alibi involving a time loop"). The officer deletes the time loop, the log records a careful review, and a swapped road sign sails through — because nothing about it looks wrong. Outlandish errors "may be more easily corrected," the authors note: a Utah draft that said an officer had been turned into a frog, after the software picked up The Princess and the Frog playing in the background, was corrected before the report was filed. Utah lawmakers tried this year to make agencies publish whether officers may switch such safeguards off; the bill died on March 6.

Imagine the summary becoming the record. Axon told investors in May that its Brief One works by "compressing hours of video review into minutes through AI-powered summarization"; Mark43 sells a BriefAI that summarizes case information. The study tested neither. But picture the prosecutor, the defense lawyer and the judge each reading the summary instead of the footage, and the officer, a year later on the stand, refreshing a memory from a report the machine drafted.

Imagine the interview going the same way. In an MIT Media Lab experiment (a 2024 preprint), a chatbot interviewer whose questions included five misleading ones induced "over 3 times more immediate false memories than the control" in a simulated witness interview.

And imagine it leaving policing. Axon says "Draft One, for example, is expanding into healthcare," where clinicians already sign AI-drafted notes; in the study I wrote about in August, one in seven notes was signed with no edits at all. Sim's own next question is whether this can "manipulate people's memories of police-civilian interactions." The answer isn't in yet.

What a signature proves depends on whom you ask

Who else is worried, and who isn't?

On the civil-liberties side, the ACLU's Jay Stanley warned in late 2024 that an AI rehash of the footage "can reshape and contaminate the officer's memory," and concluded that "we do not think police departments should use this technology." (This study comes close to measuring that warning, if not in officers.) The Electronic Frontier Foundation calls the label laws "an important first step" and predicted in December 2025 that more states would join in "regulating, or perhaps even banning" AI-written reports. EPIC's Calli Schroeder put the stakes in a line: an AI transcript or summary "may be 98% accurate, but that 2% could completely change who is at fault."

Even Seacrest warns that "automation bias — the tendency to defer to computers — can lull officers into a false sense of security." Ben Green, a policy scholar who surveyed 41 policies requiring human oversight of government algorithms, concluded that such policies "provide a false sense of security in adopting algorithms."

The study's authors see their work as part of "growing evidence that the human-in-the-loop strategy is not enough to account for AI's mistakes." Sim calls AI "a new method of delivering misinformation." Their deeper point is a question rather than a verdict: "whether AI should be used in these contexts at all."

In the middle sits the Council on Criminal Justice's task force (its funders include Microsoft). "Automation bias is acute in this context," it says, and its fix is the most practical on the table: where feasible, an independent statement from the officer, written before reviewing the AI draft, "to preserve independent recall."

Every voice here keeps a human in the picture. The quarrel is over what that human's signature proves: a safeguard, or a false sense of security.

What does this mean for you?

• Write down what you remember before you read the summary. It's the task force's advice for officers, and you can borrow it for any meeting. In one study, recall within 24 hours helped preserve eyewitness memory for at least a month; whether it also shields you from later misinformation is contested, so treat it as a habit that may help.

• Treat the summary as a claim. As I wrote in August about AI search answers, "Treat the summary as a claim, not a conclusion." For anything that matters, go back to the recording, the thread or the source.

• Look for what's missing, not just what's wrong. Nineteen of twenty summaries in the study left out the collision itself.

• Don't count on the label, or on your own skepticism. In the study, neither helped measurably (a finding the authors read cautiously, and so should you).

• If you sign it, you're vouching for your memory, not the machine's. California's signature line says the facts are "true and correct." Before you sign anything a model drafted (a report, a chart note, the minutes), check the details that matter against the source, not the draft.

• If you or someone close to you faces a criminal case, know what to look for. In California, the report must say AI helped write it and the first draft must be kept; ask the lawyer for the retained first draft and the audit trail, as my September piece advised. In Utah, look for the disclaimer and the certification. In King County, prosecutors say they won't accept AI-assisted narratives. Elsewhere, ask the department in writing whether it uses AI drafting.

The lesson, as I see it

The human in the loop was meant to be the check on the machine. This study suggests the loop runs both ways: the machine's draft can edit the human, too. That doesn't make a signature worthless, but it makes it a different promise from the one the law assumes, closer to I read this and it seemed right than to this matches what I saw.

I've written about automation bias, "a failure in the moment, with the tool present," and about what's left of a skill once the tool is taken away. This is a third failure, and a quieter one — the tool's mistake becomes your memory, and you sign it in good faith.

What to watch? Los Angeles police commissioners approved a $235 million Axon contract in September, and its text says Draft One's phased rollout to officers begins January 2028, with a pilot when the department is ready after the contract is executed. Wayne County's policy is still being written, and Connecticut's pause, as last reported, holds.

King County's prosecutors didn't want officers unwittingly "certifying false police reports," so they refused the draft. The legislatures that acted kept the draft and trusted the signature. Whichever way your own jurisdiction goes, the cheapest protection is yours to take: write down what you saw before a machine tells you what you saw.

Whoever signs off on machine-drafted summaries near you (a sergeant, a nurse, the person who keeps the minutes) deserves the test at the top of this piece. Send it their way.

"The robots did not take your job. Aggregate unemployment is still hovering around 4% — historically low, boringly stable. What's vanishing isn't your rung. It's the first one. The one your kid needs."

In September 2026, two working papers built on government data tested that claim. One finds that new graduates' unemployment did not spike in summer 2026. The other finds that since ChatGPT's release, graduates of the most AI-exposed majors have been less likely than others to land a job right away — and have started at lower pay. They confirm part of what I wrote and complicate another part, and a revised Stanford study updates one number.

So, a scorecard. What holds: the unemployment rate is the wrong instrument for this. What needs updating: the Stanford figure I cited, "a 16 percent relative decline in employment" for 22-to-25-year-olds in the most AI-exposed jobs, is about 19% in the team's August 12, 2026 revision (descriptive, its authors note, not causal). What I put too simply: I wrote that "the rung is still gone, and the kid is still standing on the ground." In the second paper, the graduates are not on the ground. They "remain strongly attached to the labor market, but they adjust to weaker demand at entry." In the three tenths of majors just below the top, the pay gap faded within a year or two; the group still behind is narrower than "your kid," mostly computer science and its software cousins.

One paper counted the jobless. The other followed the paychecks.

Start with the reassuring paper, because the reassurance is real. Robert Fairlie and Jane Wu of UCLA used the Current Population Survey (the monthly household survey behind the official unemployment rate) to study 22-to-25-year-olds whose highest degree is a bachelor's and who are out of school — their stand-in for the class of 2026. Their working paper for the National Bureau of Economic Research finds that "unemployment rates did not spike in summer 2026 relative to summer months in previous years," and did not rise significantly against older graduates or young workers without a degree.

Averaged over June through August, their group's unemployment rate was 7.3% in 2026, against 6.3% to 7.8% in the four summers before — "within the normal range of variation." Counting graduates who want a job but aren't looking (the authors' "sidelined unemployed") "adds nearly two percentage points to the unemployment rate of recent college graduates" on average from 2022 to 2026, and still shows "no evidence of a statistically significant increase in summer 2026." (In summer 2026 alone, that broader rate hit 10.4%, a five-summer high, though only 0.3 points above the previous high.)

The authors add that their findings "do not rule out larger effects in the future." So far, so good. Now the second paper.

In "Graduating into Disruption," three Census Bureau researchers — Cody Orr, Lee Tucker and Lawrence Warren — used records that link graduates' majors to their later jobs, and asked not only whether graduates found work, but what work, at what pay:

"In regression-adjusted estimates, the most AI-exposed decile of college majors saw their likelihood of initial employment decline by five percentage points, while full-quarter initial earnings declined by thirteen percent."

In plain English: compare the tenth of majors the authors rate most exposed to AI with the six least-exposed tenths, before and after ChatGPT arrived in late 2022. The chance of any job in the quarter after graduation fell five percentage points. Pay in the main job two quarters out, for those who worked the full quarter, fell 13%, a drop the authors call "comparable in magnitude to the earnings losses associated with graduating into a large recession."

That top tenth is "heavily dominated by computer science, information systems, and other majors linked to software development," with math, statistics, electrical engineering and journalism also in it. (Accounting sits one tenth lower.)

Where did the pay go? About half the drop was lower pay within the same industries, "with the remainder resulting from a shift in the industry mix into lower-wage sectors such as restaurants and retail." (The records show the employer's industry, not the graduate's job, so don't picture software majors behind a register.)

Two caveats. The paper's cover notes that Census working papers "have not undergone the review accorded Census Bureau publications and no endorsement should be inferred"; the data are the government's, the conclusions the authors'. And the sample covers roughly 29% of U.S. bachelor's degrees conferred from 2016 to 2024, from schools more likely to be public, large and research-intensive, with job records ending in the third quarter of 2025. The class of 2026 is not in it.

Nor is it a lone result. In Texas records, two Dallas Fed economists found the same shape: after ChatGPT, graduates of more-exposed majors were less likely to find a Texas job within a year, and their first-year earnings fell about 5% relative to less-exposed majors.

So how can both be true?

Because they measure different things. An unemployment rate asks whether you have a job, not which job, in what industry, or for how much. A software major who wanted a developer job and took a lower-paid one elsewhere counts exactly like one who got the developer job: employed.

Writing about earlier studies, the Census authors put it in one sentence: "modest employment or unemployment effects can coexist with substantial deterioration in job quality and early-career opportunities." As I read it, that fits the UCLA paper, too. Alex Imas of the University of Chicago and Jacob Schaal, reviewing the evidence on September 29, 2026, make the connection explicit: "a sharp drop confined to a few exposed majors, as in Orr, Tucker and Warren, would barely move this average." The UCLA sample, they add, "can't rule out rises of 2–3 percentage points."

Economists at Anthropic (which makes the Claude chatbot) warned in March 2026 that "slowed hiring may not necessarily manifest as increased unemployment": many young entrants "may exit the labor force rather than appear as unemployed."

As I put it in July, the top-line rate is "measuring the lake, not your dock." The Census paper measured a dock.

Is it the chatbots? The skeptics' best case

So is it AI? The skeptics deserve a fair hearing.

First, timing. In the Census data, "real earnings in 2022 among more exposed graduates had already begun to decline in comparison to those of less exposed graduates," which the authors call "congruent with an underlying pandemic recovery explanation for the observed pre-trends." The odds of a first job, by contrast, break sharply at ChatGPT's arrival. Another team's January 2026 preprint found that unemployment "risk rose in AI-exposed occupations beginning in early 2022, months before ChatGPT," though it tracks occupations, not majors, and it found that graduates who took more AI-exposed coursework "had higher first-job pay and shorter job searches after ChatGPT."

Second, remote work. Writing on the New York Fed's Liberty Street Economics blog, three researchers estimate that "remote work can explain 64 percent of the recent increase in unemployment among young college graduates." But that is an argument about unemployment, not pay, and the Census estimates "are robust to controlling for differences across majors in their work-from-home intensity."

Third, the paper's own caveats. Taken at face value, the authors write, rising self-employment and graduate-school enrollment may explain up to half of the five-point employment drop, though they add that this "need not imply that our baseline estimates overstate AI's effects, in particular on earnings." All told, they conclude, the evidence points "to a substantial role for generative AI in shaping the labor market entry of recent graduates," while conceding their design cannot rule out other shocks to particular fields arriving at the same time.

Where does that leave the June piece's verdict, "circumstantial — early, converging, but not yet conclusive"? I think September firmed up more of the what than the why: graduates of the most exposed majors are measurably worse off, and whether AI is the main reason is still argued, in good faith.

Denmark's still water, and the current underneath

Denmark comes at the question from the other end. Anders Humlum of the University of Chicago and Emilie Vestergaard of the University of Copenhagen, working with Statistics Denmark, linked surveys of chatbot adoption to administrative labor-market records: 25,000 workers in the late-2024 round, in 11 highly exposed occupations from accountants to software developers, tracked through December 2024. (First circulated in 2025 as Large Language Models, Small Labor Market Effects, the paper is now titled "Still Waters, Rapid Currents," the same water image I reached for in July.)

Comparing adopters with non-adopters, they find "precise null effects on earnings and recorded hours at both the worker and workplace levels, ruling out effects larger than 2% two years after the launch of ChatGPT." What moves instead, they write, "is the structure of work."

Case closed? Not quite. Young Danes lost ground too: the early-career share of employment in exposed occupations (ages 22 to 25) slipped about 0.6 percentage points from a baseline of about 8% between October 2022 and December 2024. But the authors' analysis "reveals that the declines are not driven by firms adopting AI chatbots"; "changes in the macroeconomic environment or anticipatory hiring freezes unrelated to actual adoption" may be behind them.

So look at what each design can see. Denmark's design measures what using AI did to the people and firms using it. The Census paper fixes exposure by major, before anyone is hired. Its authors note that effects on early-career workers "seem to precede widespread AI adoption by" firms, and float a reason: AI "may also affect the information available to employers when hiring new workers," blurring signals like "grades, assignments, and work samples." As I read the two designs, that channel would barely register as a gap between adopters and non-adopters, since every employer reading a transcript faces it. Small effects on people already inside the building; a large one at the door. Both can be true.

Neither paper has been through formal review. And Denmark is less exotic than it sounds; the authors call its labor market "highly flexible, with low hiring and firing costs—similar to those of the U.S.," though union density there is 65%, and they say only that their insights "may extend" to America.

The class of 2027's first offer

Fairlie and Wu close with a conditional warning: if AI use at work keeps intensifying, "the graduating classes of 2027 and later might be more affected than the class of 2026." So imagine it. To be clear, what follows is my extrapolation, not anyone's finding.

Suppose you graduate in May 2027 from a top-tenth major. In late summer, a new paper finds your age group's jobless rate inside the usual range again, and headlines declare that AI still hasn't hurt new graduates. You do have a job: in an industry you didn't train for, at a salary your predecessors would have turned down, landed through a paid trial project because employers no longer trust grades and work samples to show who can do the work without a chatbot. None of that moves the number on the news.

Some of it has started. Nationally, computer and information science enrollment at four-year institutions had fallen 8.4% by spring 2026, per National Student Clearinghouse figures in AP reporting. In the same report, Tracy Camp of the Computing Research Association said of employers: "If they don't change how hiring is currently happening, they're not going to have mid-level career people in a few years." Push that to 2030, and the firms that skipped junior hiring go looking for seniors nobody trained, from a pipeline of students who picked other majors. (That part is my guess, not hers.)

Same squeeze, different suspects

The Manhattan Institute's Allison Schrager told the class of 2026 in June, months before the Census paper, to blame work-from-home, not AI: "AI is not ruining your job prospects, at least not yet." AEI's Brent Orrell sees AI absorbing junior-level tasks — "people who used to assign routine work to assistants are assigning it to AI instead" — and calls it "a classic example of the tragedy of the (skills) commons."

A Stanford SIEPR brief by Neale Mahoney, Erika McEntarfer (who led the Bureau of Labor Statistics until August 2025) and Karsen Wahal finds that entry-level hiring in AI-exposed occupations "clearly declined markedly around 2022," but that it is harder to say whether that is "clear evidence of AI's impact on demand for young workers." Stanford's Erik Brynjolfsson told NPR that "AI is not the whole story, but it's part of the story and the evidence is building," while Harvard's David Deming, pointing to the timing, said, "I think it's more like remote work."

The Roosevelt Institute's Michael Madowitz argues the problem is real whatever the cause, because "higher education isn't providing the same protections for young workers as it used to."

Imas, surveying the evidence, lands about where I do: "The best current evidence supports a narrow claim: AI may already be affecting the hiring margin for junior white-collar roles most exposed to AI, but this attribution is contested, and aggregate labor-market disruption has yet to appear in the data."

What does this mean for you?

If you're choosing a major, weighing a first offer, or paying for either, here is what the evidence supports — information, not guarantees.

• Look up the program, not just the field. The Education Department's College Scorecard shows "the salaries and debt of graduates" by field of study at each college. Mind the vintage: as of October 3, 2026, its field-of-study earnings are for graduates of the 2014-15 through 2019-20 award years, one year out, all before ChatGPT. For the most exposed majors, I'd read them as a ceiling, not a promise.

• See where a program's graduates land. The Census Bureau's PSEO Explorer shows graduates' earnings 1, 5 and 10 years out and maps the industries where they go to work, the very margin that shifted. It covers 1,117 institutions, about 40% of graduates, as of August 27, 2026. Its public tables, as of October 3, 2026, stop at the class of 2021.

• Ask about underemployment, not just unemployment. As of the second quarter of 2026, the New York Fed counted 42% of recent graduates in jobs that don't need their degree; its outcomes-by-major table, updated each February, is the place to compare majors.

• Read a lower-paying first offer as a starting point, not a verdict. In the Census data, job switching rose and the pay gap narrowed; for the three tenths of majors just below the top, it all but closed within one to two years. For the top tenth, the researchers "cannot yet assess when or whether exposed graduates will catch up."

• Think hard before a same-field master's. In the Texas study, new master's holders in exposed fields "experienced similar relative declines in earnings as four-year graduates," and the economists suggest that "the returns to formal upskilling within AI-exposed fields may be limited." One state, but worth knowing before you borrow.

• Don't flee a major because of a headline. The worst of it is concentrated in the top tenth, and the preprint above tied AI-exposed coursework to higher first-job pay. If you're a parent, skip "Did you get a job?" Ask which job, at what pay, and what it leads to.

The lesson, as I see it

In June, I warned that if we kept watching only the unemployment rate, the robots would "take something quieter and more permanent." September's papers suggest the quieter thing is measurable: not a missing rung for everyone, but a lower one for some, concentrated in a handful of majors, with a cause still in dispute.

Policy built on unemployment rates and layoff counts will miss it. Layoff notices count people who are let go; in August, I wrote about the case these forms cannot see, a layoff too small to trigger them, and the hire that never happens is the same blind spot, wider. California's SB 951, signed September 30, 2026, at least gives it a name — "technological cessation in hiring," a permanent end to hiring for a job, caused at least partly by AI or other automation — but requires no one to report one; on hiring, it orders only a state report, due "On or before January 1, 2028." That's a start, not a measurement.

What would help? Faster data: public earnings tables that don't run years behind the market these papers describe. Job-quality measures: what new graduates earn and in which industries, not just whether they work. Then watch the New York Fed's next quarterly update, expected in November, and summer 2027.

My vote? Keep June's warning, and sharpen it. The robots didn't take your kid's first job, at least not in these data. For some majors, they (or something arriving at the same time) made it smaller and slower to come. That's harder to see than a layoff, which is exactly why it's worth counting.

Choosing a major and weighing a first offer are big decisions made on old data. If a student or a new graduate you know is facing one, bring this piece into the conversation before they decide.

Wharton's Ethan Mollick describes the first one precisely: you may want guidance "on how to approach your homework, but it will often just give you the answer instead." The University of Maryland tested the second assumption, running a randomized trial of its own AI tutor in fall 2025 before considering whether to deploy it campus-wide.

Its working paper, dated September 30, 2026, reports that in sections of the same course, final grades came in 4.12 points lower out of 100 where students were offered the tutor, and that they took part far less on the course site. Yet only about 15 percent of the students offered it ever used it. Figuring out how both can be true changes what you should ask before your student leans on one of these tools.

Thirty-four sections, instructors assigned at random, and a chatbot inside the course page

How do you test a tutor fairly? You take the choice away from the students. Randomization "occurred at the instructor level": within blocks of matched courses, each instructor was assigned either to switch the tutor on for the whole class or to change nothing. The study ended with 30 instructors, 2,379 students and 34 course sections, half of them offered the tutor. Nine blocks were sections of the very same course, and that comparison (22 instructors, 1,353 students) is the cleanest, because it "holds course content fixed." Three instructors assigned to offer the tutor never switched it on and were dropped afterward (purists will wince: removing people after randomization can tilt a comparison, and the paper doesn't show results with them left in).

The tutor, the university's Virtual Study Assistant (VSA), was a GPT-4o chatbot built into each course's page. The university's IT division recruited instructors with a promise to "Reduce the amount of repetitive questions during your office hours" and a switch between "answer mode (providing direct answers)" and "tutor mode (guiding students without providing direct answers)." The default gave answers, and only two instructors finished the semester in the guided mode. (Hold on to that detail.)

Maryland's tutor is a different animal from the one I set against an English schools trial in September — Harvard's physics tutor, whose students learned significantly more in less time than in an active-learning class, and which I described then as "a tutor purpose-built on pedagogical principles, used by consenting undergraduates."

So what did it find? In the same-course comparison, being offered the tutor came with final grades 4.12 points lower (0.37 standard deviations). Across the full sample (the paper's primary analysis, mixing different courses), the authors report "not significant evidence of adverse treatment effects," likely, they say, because of "the lack of alignment between courses and grading."

What held everywhere was engagement. In the same-course comparison, students offered the tutor logged about 26 fewer recorded activities on the course site (discussion replies, quizzes and the like) and about seven fewer active days; the authors call the engagement effects "large and statistically significant in both samples." They add that this does not show the drop caused the lower grades, only that the two "tended to co-occur among treated students."

Who is telling us this? The lead author, Jing Liu, is the founding director of the university's Center for Educational Data Science and Innovation; his co-authors include the university's chief information officer, Jeffrey Hollingsworth, and its provost, Jennifer King Rice. That cuts both ways (an institution grading its own product), but I credit them for publishing a result this unflattering. It is also a working paper in EdWorkingPapers, a series whose papers "have not gone through a peer review process."

The tutor most students never touched

How does a tool that about 85 percent of the students offered it never touched move anything? First, what was measured: every headline estimate is the effect of being offered the tutor, not of using it. Of the roughly 15 percent who used it at least once, about 40 percent had a single session. And in the raw same-course averages, "lower final grades were not confined to students who used the VSA but were similar to those who did not use the tool." This study does not show that students who used the tutor did worse than classmates who didn't.

Second, weigh the authors' explanation, offered as an interpretation, not a finding. Students in both groups already had other university-supported AI tools, and the authors suspect that introducing the course tutor changed AI use more broadly: the trial "likely evaluates an impact of broader AI use induced by introducing the VSA and not just the isolated effect of individual VSA use." In a survey (answered by only 18 percent of students, so a clue rather than a count), treated students were more likely to agree that "I asked the instructor fewer questions about course content," roughly 57 percent against 44. The findings, they write, "suggest that introducing an AI tutor may displace engagement with existing learning activities without improving academic performance."

And what did users ask for? Of 3,460 requests, 73.8 percent were classified as "direct-answer requests," a broad bin covering facts, definitions and conceptual explanations as well as solutions; requests for feedback on students' own work were "particularly rare." Such requests do "not necessarily indicate cognitive offloading" (handing the thinking itself to the machine), the authors note, but the results "suggest that students see the VSA as a source of immediate information gathering rather than as a partner in sustained, interactive learning."

One flag, not a verdict: the estimated grade losses among first-generation college students were "more than twice those among continuing-generation students in both samples," which the authors call "the clearest recurring pattern" among student groups, though "statistical precision varies across outcomes and samples."

What would make the four points disappear?

The strongest objections come from the paper itself. First, the outcome is the grade each instructor gave, not an independent test; the authors concede that this "makes interpreting a learning effect challenging," and they couldn't see which exams were proctored. The same-course comparison rests on 22 instructors, the treated ones older on average (about 55 against 40) and assigning fewer homework points, and "sections may still differ in grading." The authors ran an extra check suited to so few groups and report, "Our conclusions are robust to this approach."

Second, the tool was barely introduced. Of ten treated instructors who answered a survey, all mentioned it, 40 percent demonstrated it, and "none incorporated it into tasks or assignments"; the authors say more training might have changed the results.

Third, fewer page views "could reflect more efficient information retrieval, which is one goal of the tool's design," the authors grant. But homework submission held steady while broader participation fell, a sign, they suggest, that students "may have lowered their broader engagement with course activities while continuing to meet assignment requirements."

So do AI tutors lower grades? Liu himself warns against that reading: "These findings do not establish that purpose-built AI tutoring tools are not beneficial," he wrote in a post that EdTech Innovation Hub quoted on October 2, 2026.

Here is where things get interesting. The obvious fix, a tutor that guides instead of answering, hits a different wall. Over two years in 18 Tennessee middle schools, when Khan Academy's Khanmigo refused and instead asked questions or offered hints, students "largely stopped using it" (Khan Academy's founder says its current version pops up on its own after a wrong answer). The researchers, Philip Oreopoulos and Nina Low, concluded in a National Bureau of Economic Research working paper, also not peer-reviewed, that "realizing the promise of AI tutoring will require getting students to use it, not just giving them access." And in a field experiment with nearly a thousand high school math students in Turkey, published in PNAS, those given unrestricted GPT-4 did worse once it was taken away than peers who never had it; a guardrailed tutor version "essentially eradicated" that harm, "though we still do not observe a positive effect."

In short, a tutor that hands out answers may crowd out the work that teaches — and one that withholds them may go unused. Either way, the question is what the tool replaces.

South Korea ran the experiment in the opposite order

What does scaling first and checking later look like? South Korea gave AI textbooks official status, then legislated it away.

In November 2024, Korea's Ministry of Education approved 76 AI digital textbooks in English, math and coding for 2025, pressing ahead, the Korea Times reported, "despite concerns about the effectiveness of digital learning." The plan was AI textbooks in every school. It never got there. On January 21, 2025, Acting President Choi Sang-mok vetoed a proposed revision of the Elementary and Secondary Education Act that would have made them optional educational resources, warning of "a significant blow to the national competitive edge," but limited 2025 to schools that volunteered. That March, 3,870 of 11,932 schools (32.4 percent) had chosen them for at least one subject; "Use of the AI textbooks is optional," the Korea Herald noted.

Then the government changed. On August 4, 2025, the National Assembly voted to reclassify the AI textbooks as "education materials" after resistance from teachers and concerns about screen time, literacy and budgets, Yonhap reported; lawmakers of the opposition People Power Party denounced it as a setback for classroom innovation that deprives underprivileged students of educational opportunities. The ruling Democratic Party passed it "unilaterally," effectively removing "the legal and financial foundations for using AI digital textbooks in schools." The law, in force since August 14, 2025, says AI learning software cannot be approved as a textbook, and as of October 3, 2026, it still does.

The audit came last. In December 2025, Korea's Board of Audit and Inspection found that the ministry had promised a 2024 pilot and "skipped the pilot entirely due to tight development timelines." In schools that chose the textbooks, an average of 60 percent of students never logged in even once, the Kyunghyang Shinmun reported, and the auditor told the ministry to pilot any new kind of textbook and verify its effectiveness first. By the first semester of 2026, Education Ministry figures in the same paper showed 622 schools (5.2 percent) still using them, down from 4,095 (34.2 percent) a year earlier; a ministry official cited shifting perceptions after the change in legal status, among other things.

Kim Cha-myung, an elementary school teacher who found the textbooks convenient, put it more simply: "The program failed because everything was rushed; it should have been rolled out gradually after testing its effectiveness."

To be clear, this compares approaches, not results: nothing here measures Korean students' learning against a control group, and the ministry skipped the very pilot that might have. Korea pushed access from the top and then reversed it by law; Maryland measured first.

Imagine the syllabus of 2029

Maryland ran its trial "prior to considering campus-wide deployment." As of October 3, 2026, no campus-wide rollout had been announced, and the university still lists the assistant among its AI services with a button that reads "Request a deployment." So what follows is my extrapolation, not a forecast.

Imagine every course page shipping with an assistant switched on in answer mode, because defaults stick (few of Maryland's instructors changed it). Imagine the budget meeting where "Reduce the amount of repetitive questions during your office hours" quietly becomes an argument for fewer teaching-assistant hours. Imagine your questions becoming data: instructors can already view students' anonymized prompts in an administrative console, and the authors note that being watched "may also have influenced what students were willing to ask." Scoring those prompts as participation is a short step.

And imagine the whiplash: a state that makes AI tutors official after one election and strips that status after the next, much as Korea did with its textbooks, with no one measuring what students learned in between. As I wrote in August about ten AI-in-schools laws passed by states in 2026, "only one wrote down what the software may not decide."

There is a better version, and an optimist has sketched it. AEI's John Bailey imagines "a coordinated team of AI agents," one of them "deciding when to offer a hint versus when to let the student struggle." That is nearly the opposite of Maryland's default, and which one students get is a configuration choice.

The left, the right and an AI optimist end up in the same place

Who else sees it this way?

On the center-left, Brookings concluded in January 2026 that at this point in AI's trajectory "the risks of utilizing AI in education overshadow its benefits," though tools "explicitly designed to support the learning of children and youth" can "foster enriched learning experiences." (Its subject is school-age students, not undergraduates.)

At MIT, an ad hoc committee on AI in teaching and learning reported in August 2026 that AI has driven "decreased attendance at office hours, reduced participation in online discussions," and warned of "cognitive surrender," when students "fall back on AI at the first hint of struggle."

On the center-right, Bailey argues that "AI works in education when it's used not to give answers but to orchestrate the conditions for productive struggle." On the right, the Manhattan Institute's Brian J.A. Boyd warns, in a report for public university boards, that "The greatest risk of AI to higher education is simply that it will be a substitute for, rather than a complement to, human thought," and says AI "should be banned from the core curriculum." The Heritage Foundation's Annie Chestnut Tutor and Jonathan Butcher, warning that "AI tools designed to supplant cognitive effort can undermine rather than support student growth," want chatbot tutors studied "before deploying them at scale in schools."

Mollick names the mechanism: "the default mode of AI is to do the work for you, not with you."

Set Boyd's sentence beside the Maryland authors' call to study whether design and teaching "can enable AI to be a complement to, rather than a substitute for, existing opportunities for practice, feedback, and human interaction." A conservative think tank, an AI optimist and the tool's own evaluators start from three places and land in the same one: AI as a complement, not a substitute.

What does this mean for you?

• Ask which mode the course tool is in. Maryland's default gave answers. If your instructor can flip the switch, ask for the one that guides.

• If you study with a general chatbot, try its learning mode, and know its limits. ChatGPT's Study Mode, Claude's Learning Mode and Gemini's Guided Learning each launched in 2025 as something you choose to turn on. That is the catch: when the Tennessee tutor withheld answers, students largely stopped using it. A guided mode works only if you want it to.

• Try first, then ask for feedback on your attempt. It was the request Maryland's students almost never made. In the Turkish trial, the guardrailed version avoided the harm (though it produced no gain).

• Keep asking people. Office hours and questions to instructors "may feel inefficient, but they are essential building blocks of learning," Liu wrote. The help a bot replaces may be the help that was doing the teaching.

• Do some of the work cold, on purpose. The line from my piece on endoscopists fits homework too: "schedule the unassisted rep."

• If you are the first in your family at college, or raising someone who is, know that the estimated losses were larger for first-generation students: a reason to guard office hours and study groups, not for alarm.

• Parents and campus decision-makers: ask for the evidence before the rollout, and ask what the tool replaces. Liu's test: "when evaluating an AI tool's impact on learning, we need to consider what it might replace." If no one can name it, ask for a pilot first.

• Read the headline twice. Offered is not used. A story that says students who used the Maryland tutor got lower grades has misread the study.

The lesson, as I see it

Access is not learning. It sounds obvious written down, yet I suspect it is the unspoken premise behind a great many AI rollouts, and behind the comforting thought that help at two in the morning must be good help.

Maryland deserves credit for doing what Korea skipped: it tested before scaling and published an unflattering result with its own provost's name on it. My September piece praised Estonia for spending public money to find out whether its bet paid off, in a line that fits Maryland too: "That is the posture worth copying. Not the confidence. The checking."

What should you watch? If the university moves toward campus-wide use, ask which mode ships as the default. And Liu has said that a second paper, from a separate study, would follow, EdTech Innovation Hub reported on October 2, 2026. Read it — and whatever evaluation comes next — with the two questions this one taught: what did the tool replace, and did it answer, or teach?

Offer the tutor, by all means. Then count what it replaced.

The HAIA Foundation argues for AI that leaves people more capable, and for testing that promise before anyone scales it. Subscribe if you would rather read the results than the brochure.

You probably have no idea what you agreed to. The trouble is less your carelessness than a mechanism, one that has been quietly turning ordinary software agreements into artificial-intelligence agreements, often without anyone signing anything new.

What changed in August

On August 17, 2026, Atlassian — the company behind Jira and Confluence, which between them hold the project plans and internal documentation of a very large slice of the working world — began using customers' metadata and in-app data to improve its apps and AI features. The plan was public months ahead, and Atlassian's own FAQ says the change is reflected in our customer terms, with an updated customer agreement, AI terms, data processing addendum and privacy policy all taking effect that day.

The Register put it more bluntly in April: unless a customer pays for the most expensive license or the law forbids it, Atlassian will collect their data to train its AI models. And for customers whose highest active plan is Free, Standard or Premium, Atlassian's head of product communications, Arseny Tseytlin, told the outlet, metadata contribution is always on, and they are not able to opt out.

Not opt out by emailing support. Not opt out in the admin console. Not able to.

How did a change that large reach customers without a signature? Through a clause in the agreement itself. Atlassian's customer agreement lets it modify this Agreement (which includes the Policies, Product-Specific Terms and DPA) from time to time, by posting the modified portion(s) on its website, using commercially reasonable efforts to post each change thirty days before it takes effect. Customers can subscribe to email notice of those updates. By default, the contract changes by being posted.

To be fair to Atlassian, that is the careful version. Paying customers ordinarily get new terms at renewal, and when Atlassian brings a change in mid-term — to comply with the law, or to reflect new product features — a customer who objects may terminate the rest of the term for a refund, provided it says so within thirty days. That exit is the whole remedy. You can leave; you cannot say no and stay. Free accounts get less: their changes take effect during the term, per Atlassian's notice.

Careless versions are common enough that a law firm advising buyers warns such changes often arrive without a contract amendment, without updated data processing terms, and without formal notice that the nature of the platform has materially changed.

The mechanism is older than AI. The Electronic Frontier Foundation's 2005 guide to dangerous license terms reproduced a clause under which a customer's continued use of a service will be deemed to constitute your acceptance of whatever terms the company has since added. Two decades later, the same move decides whether a machine learns from your customer records.

What, then, should the contract say? Fifteen things, sorted not by importance but by who already owes you what.

Tier one: five the law already writes down

Europe's AI Act contains a joke that is easy to miss and hard to unsee. For the systems it classes as high-risk, it puts duties on the buyer — the "deployer," in the jargon — whose subject matter sits inside the vendor's building. Other duties below fall on the vendor, and they only help you if your contract makes them usable.

Start with logs. For high-risk systems, the Act requires the deployer to keep the logs the system generates — to the extent such logs are under their control, and for at least six months. Those rules take effect on December 2, 2027 (more on that date in a moment). Now reread the scoping clause. In a hosted product — almost everything you buy — the logs sit on someone else's servers under someone else's retention policy. The narrow reading is that your duty then shrinks to nothing. The better reading, I think, is that the law has just told you where control has to come from: your contract.

1. Log access, export, and retention. Ask for it in writing, and ask for it to survive termination.

2. The documentation pack. For the same high-risk systems, the Act directs deployers, where applicable, to use the information the provider must supply when they carry out a data-protection impact assessment. You cannot use what you were never sent. Make the provider's full documentation — not just the instructions for use — a contract deliverable, updated whenever the system changes.

3. Subprocessor and sub-model disclosure. If you handle Europeans' personal data, you may already hold a version of this right: where a processor has general permission to add subprocessors, European law requires it to tell you about each new one, giving the controller the opportunity to object to such changes. The AI wrinkle is that when your vendor swaps the foundation model under its product, it may be adding a new subprocessor — possibly in a new country, mid-contract. So the right may already be in your paper. The question is whether the notice reaches a person or a changelog.

4. Material-change notification. Colorado rewrote its AI law this year. The replacement, which takes effect January 1, 2027, regulates automated decision-making technology used in what it calls consequential decisions, and it obliges developers of those systems to give deployers notice of any material updates or modifications. It gives you no private right of action; enforcement belongs to the state attorney general alone. A statutory duty you cannot enforce yourself is a reason to copy it into your contract.

5. The rebranding clause. Put your own name or trademark on a vendor's high-risk AI system and the Act treats you as its provider, with every obligation that implies — without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated. That carve-out appears only in the rebranding provision; the neighboring provision on making a substantial modification carries no such language. So ask for two things: a clause allocating the provider's obligations if you rebrand, and a warranty that the way you plan to use and configure the system will not amount to a substantial modification. Here the statute itself invites the negotiation.

When do these apply? The Digital Omnibus entered into force on July 27, 2026 — six days before the high-risk rules had been due to apply — and the Commission now says those rules for high-risk AI systems will apply starting December 2, 2027 (later still, August 2, 2028, for AI embedded in products). Items one, two and five fall under those rules. Treat the delay as lead time rather than relief: a three-year agreement signed this week is still running on that date, and unless someone thought to write it in, it has no mechanism for pulling the documentation forward when the duty lands.

Tier two: five somebody has already conceded in writing

For most of these, a major vendor has already published the clause — which turns please into your competitor already does this.

6. No training on your data — in the contract, not on a settings page. Both big model makers publish reassuring pages, and both lean on the same two words. OpenAI's reads: We do not train our models on your data by default. Anthropic's reads: By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models. A default is a setting, and settings change with product updates. The firmer promise sits in each company's contract. OpenAI's business terms state that OpenAI will not use Customer Content to develop or improve the Services unless the customer explicitly agrees, and Anthropic's commercial terms say it may not train models on Customer Content. Even contracts move — OpenAI may update its agreement on reasonable notice, including by posting the update on its website, and Anthropic's updates take effect thirty days after they are posted — but a contract changes through a process with a notice and a date. So when a vendor reassures you, ask which document the reassurance lives in. Buyers are starting to insist on the contract version: Common Paper, which makes free standard agreements that companies use and then edit, reports that across the deals built on its templates, Prohibiting AI Training language went from showing up in under 1% of all CSAs in 2024 to 11% in 2025 and 14% in 2026.

7. An anti-degradation lock. The most useful single sentence I found in any vendor's terms sits in OpenAI's business terms. They fold in the indemnities from OpenAI's separately published service terms as they stood on the agreement's effective date, and promise that OpenAI may not materially reduce the customer's protections under those indemnities without the customer's written agreement. The lock is narrow: it covers those particular indemnities, not the whole agreement, which OpenAI can otherwise update on notice. It is still the right shape of promise. Ask every vendor to match it.

8. The indemnity has to sit outside the liability cap. An indemnity is theater if the cap swallows it. Michael Volkov, writing about AI vendor contracts on September 17, warns that such a promise can be effectively meaningless if the same contract caps the vendor's total liability at a figure like a year's fees. Several vendors have already carved it out. AWS says its defense and payment obligations under this Section 50.10 will not be subject to any damages cap under the Agreement, for the generally available AI services it lists; Anthropic's commercial terms say their liability limits do not apply to either party's indemnification obligations; and OpenAI's business terms put the indemnities from its service terms outside the cap as well.

9. Deprecation notice and version pinning. The published floors are shorter than you might guess. Unless safety or compliance concerns require a faster timeline, OpenAI promises at least six months' notice for generally available models, while preview models may be retired with much shorter notice, such as 2 weeks. Anthropic publishes at least 60 days' notice before model retirement for publicly released models. Meanwhile the control you want already exists, as a product setting rather than a contract right: Microsoft's platform offers a NoAutoUpgrade option and states flatly that Retirement dates aren't extendable. Ask your vendor to expose pinning, to stop changing behavior under a stable model name without telling you, and to give you a window to re-test. Behavior does move. Researchers who compared the March and June 2023 versions of two widely used models found that the performance and behavior of both GPT-3.5 and GPT-4 can vary greatly over time, on the very same questions.

10. An exit clause that names what was built. When the contract promises to return "customer data," ask in writing whether that includes the embeddings, retrieval indexes, fine-tuned models and agent memory built from your material. Get your source material back in a form you can reuse, too, since some of those derived pieces may only work inside the system that made them.

Tier three: where the exposure hides

Where are you most exposed? Start with the software you have not bought yet.

11. Your pilot may be on the tier with no indemnity. Four of the AI indemnities checked for this piece are written, in different ways, for paying customers or finished products. Google's covers only services not provided to Customer free of charge. AWS's covers "generally available features" of the AI services it lists. Anthropic's covers the customer's "paid use." And OpenAI's service terms exclude beta services from any indemnification obligations. Now consider where proofs of concept live. The least protected software in your organization may be the software you are still deciding about.

12. The homework hidden inside your indemnity. Microsoft's copyright commitment for customers building on its Azure AI services comes with required mitigations, among them that the customer must have run its own evaluations for infringing output — and the report of results and mitigations must be retained by the customer and provided to Microsoft in the event of a claim. AWS's indemnity likewise applies only if you "retain and provide sufficient records" to show you qualified. The protection you think you bought has a homework requirement, and the fix sits outside the contract: decide who in your organization keeps that file (it takes one email).

13. Notice before new AI features arrive. The federal government's own acquisition memo tells agencies to consider requiring vendors to provide a notification to relevant agency stakeholders prior to the integration of new AI enhancements. Your own vendor reviews may not catch these changes. Evan Rowse, a governance specialist at Vanta, makes the point in a guide that Vanta — which calls itself an "agentic trust platform" — produced and Stacker syndicated in September (weigh it accordingly): Traditional TPRM wasn't built for vendors that can materially change their risk profile without triggering a contract clause. Third-party risk management, in other words, assumes the vendor you assessed is the vendor you have.

14. Litigation-hold notice, and knowing which tier you are on. In 2025, the court hearing The New York Times's copyright case against OpenAI ordered the company to preserve and segregate all output log data that would otherwise be deleted on a going forward basis. A deletion policy, overridden by a lawsuit its business customers were not party to. Who was spared? Trade reporting on the order records that ChatGPT Enterprise, ChatGPT Edu, and business customers with Zero Data Retention contracts remain excluded from the preservation requirements. The contract tier decided it, not the privacy policy. The court ended the order going forward that fall, though logs already preserved stayed preserved, and I would not treat a carve-out from one order as permanent immunity. Where the policy page and the contract disagree, the contract is what you have.

15. A kill switch with somewhere to land. A right to switch off an AI feature is worth little if switching it off breaks the product. Published model clauses cover part of this, though they point it at you: an optional clause in Bonterms' AI Standard Clauses bars the customer from using AI features for decisions with legal or similarly significant effects on people unless it does so with adequate human review and in compliance with Laws. The vendor's half is the one to ask for by name: an obligation to keep serving you a working non-AI fallback while the switch is off.

So that settles it — read your contracts. Right?

No — and the objection deserves a serious hearing, because for many readers it is simply correct.

You have no leverage. If you run a twenty-person nonprofit, you are not redlining your cloud provider's paper. Your proposed amendment is unlikely to reach anyone with authority to accept it, and the honest answer to "how do I negotiate this" is often: you don't.

It gets worse. One legislature has already said that some risk cannot be moved by contract at all. Colorado's new statute renders void any contract clause purporting to indemnify a party for its own discriminatory use of the technology in a consequential decision. You can push a great deal of risk around with paper — not that. And enforcement of Colorado's law is currently suspended while a constitutional challenge proceeds, which tells you how unsettled all of this remains.

Two things survive the objection.

The first is that you are in better company than you think. When the Electronic Privacy Information Center went looking in 2023, it counted 621 state contracts with vendors providing AI tools. It also found procurement officials in at least forty-two states signing on to cooperative purchasing agreements — deals negotiated once, by a lead state, and then used by others to bring AI products into state agencies without competitive bids, transparency, or individualized contract negotiations. State governments with procurement staff and lawyers of their own are using AI terms they never individually negotiated, much as you are.

The second is that negotiate was never the only move. Choosing is a move. Knowing which tier you are on is a move. Items eleven and fourteen need no counterparty's consent at all.

Meanwhile, a European town council has better paper than an American hospital

What does a buyer get when a government decides to help?

If you are a public buyer in the European Union, you can download a full set of model contractual clauses for procuring AI — twenty-one articles and eight annexes, designed to be attached to your main contract, free, in twenty-four languages. Remember the logging problem from tier one, the duty whose subject matter lives in the vendor's building? The accompanying commentary contemplates letting the buying organization itself access the logs in real time, if necessary. That is the problem solved, in writing, for nothing. The high-risk version also gives the buyer an audit right to check the supplier's compliance.

Two caveats. Using them is voluntary — as a privacy lawyer writing for the International Association of Privacy Professionals points out, organizations are not legally required to use the MCC-AI — and the commentary, which labels itself a "Dynamic Working Document," predates the deadlines Europe moved in July.

What does the American commercial buyer have? The closest equivalent is that federal acquisition memo from item thirteen, and it is genuinely good. It requires contract terms that reduce the risk of switching vendors becoming cost-prohibitive, and — the line most worth stealing — it says contracts "must not prohibit agencies from internally disclosing how the vendor conducts testing or the results of testing." In plain terms, the vendor cannot stop you from sharing its test results inside your own organization.

It binds federal agencies. Not you.

To be fair — and this is my argument, reasoned from the record rather than found in it — America is not quite empty-handed. Published commercial clauses like Bonterms' exist. What is missing is an institution standing behind them, the thing that turns a template into a norm a vendor expects to be asked for.

Now imagine the version where you are not the one clicking

Push this forward a few years — no further than the term of a long software agreement.

The software stops waiting for you to click. It transacts. The plumbing already exists: in 2025, Google announced a payments protocol for autonomous agents built on tamper-proof, cryptographically-signed digital contracts that stand in for a human pressing buy. You sign a mandate up front, setting price limits, timing and other conditions, and your agent does the rest.

Now put that inside the paperwork you already have. Clifford Chance, a global law firm, warned this February that many of these systems are still deployed under legacy technology contracts written for passive, predictable software firmly under human control. An indemnity drafted for a tool that answers questions was not drafted for one that renews a subscription, accepts updated terms on your behalf (at 3 a.m., naturally), and thereby consents to model training on your customer database.

So why not let an AI read the contracts for you? Better still, let it negotiate and draft them. Will Rinehart, a senior fellow at the American Enterprise Institute, argues that telling your agent to do exactly that would be a textbook UPL violation: unauthorized practice of law, because a machine would be drafting legal documents and acting on your behalf without a license. Sit with the shape of that. The people least able to afford counsel may also be the people least permitted to automate their way around not having any.

Where the think tanks agree

Groups that want very different remedies turn out to agree on the facts.

The Information Technology and Innovation Foundation, an innovation-policy think tank writing about Canadian government cloud policy, puts the case for portability plainly: Exit options matter because providers change terms, products are discontinued, and systems become harder to untangle the longer they run. Its premise is this piece's premise: providers change terms. Its remedies run through purchasing power — making safeguards "standard, non-negotiable conditions of service" — with legal tools such as a blocking statute behind them.

The EFF, a digital-rights group, has long argued that terms of service let companies dictate their legal relationship with users through private contracts rather than rely on the law as written, on terms users never get a chance to negotiate. And a 2024 comment to federal budget officials from the Electronic Privacy Information Center, the Brennan Center for Justice and other civil-society groups made the operational version of the same point: few vendors provide the information agencies need to conduct meaningful AI testing.

Same fact, different remedies: exit on one side, consent on the other. That is much harder to dismiss as partisan than either argument alone.

Beneath both sits a piece of research that should retire a comfortable assumption. The informed minority hypothesis holds that a few careful readers discipline sellers on everyone else's behalf. Researchers tested it by tracking real browsing behavior and found that only one or two of every 1,000 retail software shoppers access the license agreement, and that most of those who do read only a small part of it. The study watched consumer software shoppers, and businesses may behave differently; among those shoppers, though, the careful minority the theory needs barely exists.

Nor does the usual fix rescue it. Omri Ben-Shahar and Carl E. Schneider, law professors whose book examines the failure of mandated disclosure, concluded that disclosure does not work; it cannot be fixed. That is an uncomfortable finding for a piece that keeps telling you to read things, and I would rather hand it to you than hide it. The answer, then, is fewer and better-chosen defaults rather than more reading.

What does this mean for you?

Concretely, this week:

• Find out which tier you are on. Not which product — which tier. Free, trial, preview and beta offerings often carry no indemnity and weaker notice promises. If something has quietly become essential, move it to a paid tier or stop relying on it.

• Name the owner of the evidence file. If your indemnity requires you to have tested and kept the report, someone has to own that. Decide who.

• Search your agreements for improvement and development. Contract language permitting vendors to use customer data for "improvement" and "development" of services has been a routine negotiating point in software deals, and those are the clauses to read closely for permission to train.

• Ask one question before every renewal: has any AI functionality been added to this product since we signed, and does any of our data reach a model we have not been told about? Get the answer in writing. A written answer is something you can rely on; a sales call is not.

• Ask for three things even when you have no leverage. Notice before new AI features. No training on your data, in the contract rather than on a settings page. Your logs on request, surviving termination. The worst outcome is that someone says no, and a no tells you something about the vendor.

• Check where the notices go. Subprocessor notices, terms updates and deprecation notices go wherever your account's contact address points. Make sure that is a person who will act on them — and if your vendor offers email notice of contract updates, subscribe to it.

• If you are the one who clicks the button — and in a small organization you are — make it a rule that no one accepts updated terms on a product holding customer data without a second person seeing them. It costs nothing and turns a reflex into a decision.

The lesson, as I see it

The contract is the last place these decisions are visible before they become invisible.

Public debate pours enormous energy into whether AI should be regulated and very little into the small private acts of lawmaking that happen in admin consoles and renewal emails, each one perfectly legal and many of them unread. Two scholars writing about public procurement described decisions made with no public participation, no reasoned deliberation, and no factual record. They meant government purchasing. I think the description fits your renewal notice just as well.

The button you clicked was probably harmless; most are. The trouble is the layer of consequential decisions now resting on that gesture — a few seconds, no record, no sign that anyone weighed it.

You will not read them all; if those software shoppers are any guide, almost no one does. So my vote is narrower and more achievable: pick the three or four agreements that hold something you would be sorry to lose, and treat them as documents rather than obstacles. You will not win every clause. The alternative is learning what you agreed to after it has already taken effect.

One product update and an unopened notice are all it takes to turn a filing cabinet into a training set. The HAIA Foundation would rather that were a decision someone made on purpose — so forward this to whoever renews your software, and subscribe before the next terms update lands.