Tech Policy & Regulation Weekly — Jul 23, 2026

Europe spent the week turning AI principles into plumbing: labels for synthetic content, access to Android features, and researcher access to X’s advertising data. In the United States, a $1.5 billion copyright settlement made training-data provenance a balance-sheet issue, while the Securities and Exchange Commission proposed making electronic disclosure the default rather than the exception.

• Amazon Quick for Legal (Amazon): Legaltech News reported its launch during the July 16–23 window. The artificial-intelligence assistant supports agentic workflows—software that can execute multi-step tasks—for contracts, compliance and legal research.
• Box Security Controls for AI Agent Access (Box): Legaltech News reported that Box introduced controls during the July 16–23 window to govern how AI agents reach files. The controls target sensitive workflows, including contracting and electronic discovery.
• Benchmark (Harvey): Harvey added the investment platform through an acquisition reported during the July 16–23 window. Benchmark is Harvey’s third acquisition since the legal-AI company began buying businesses in January.

Europe’s AI disclosure deadline is now in sight. The European Commission published final guidance on July 20 for Article 50 of the European Union AI Act. The transparency obligations begin applying on August 2, covering AI systems that interact with people and tools that generate or manipulate text, audio, images and video. (The EU’s final guidance for labelling AI interactions and generated content)

Depending on the product, providers may need to tell users they are interacting with AI or attach machine-readable markings to synthetic material. Deployers can face additional disclosure duties for deepfakes, emotion-recognition systems, biometric categorization and certain AI-generated information concerning matters of public interest. (Europe’s AI Disclosure Rules Arrive With Twelve Days to Spare)

The immediate winners are teams that already know where generated content enters—and leaves—their products. Everyone else now faces an uncomfortable inventory: who inserts the label, who preserves it after editing, and who is responsible when a customer strips it away?

Success means building disclosure quietly into interfaces, metadata pipelines and contracts before August 2. Failure will be easier to spot: inconsistent labels, missing machine-readable markers and providers arguing after launch about which party was supposed to do the work.

Brussels is forcing open parts of Google’s AI stack. The European Commission adopted two binding decisions concerning Google under the European Union Digital Markets Act on July 16. One addresses rival AI services’ access to relevant Android features; the other covers access to anonymized Google Search ranking, query, click and viewing data for eligible competing search services.

AI chatbots with search functions can qualify for the search data. That matters because an assistant’s quality depends not only on its model, but also on whether it can reach device functions and learn from the stream of signals showing what people searched for, selected and ignored. (Brussels Orders Google to Open Android’s AI Plumbing)

If the decisions work, smaller AI providers could build assistants that feel native on Android without recreating Google’s operating-system access or search-feedback loop from scratch. Google would lose some control over the inputs that make Gemini difficult to dislodge. (Brussels Orders Google to Open Android’s AI Plumbing)

The real test is not whether Google publishes documentation. It is whether competing developers can build useful products at a workable price. Restrictive eligibility rules, weak interfaces or heavily degraded data would make access technically available and commercially decorative. (Brussels Orders Google to Open Android’s AI Plumbing)

A $1.5 billion settlement turned dataset provenance into a financial liability. U.S. District Judge Araceli Martínez-Olguín approved Anthropic’s $1.5 billion settlement with authors on July 20. The authors alleged that Anthropic obtained pirated copies of books used in developing Claude; the settlement covers more than 480,000 works, and the Northern District of California dismissed the covered claims with prejudice.

The settlement does not establish that every use of copyrighted material for model training requires a license. The court’s earlier analysis distinguished between the use of books for training and the separate question of whether Anthropic lawfully obtained the underlying files.

That distinction changes diligence. “Can this material be used for training?” and “How did this material enter the dataset?” are separate questions, each capable of producing its own liability. AI developers with clean acquisition records gain an advantage; enterprise buyers and investors gain a reason to demand those records.

If the lesson sticks, licensing documents, source logs and intellectual-property warranties will become routine in AI procurement and financing. If it does not, the observable result will be another wave of cases in which a company’s model may be defensible but its library receipt is not.

The Securities and Exchange Commission wants paper disclosure to become the exception. It proposed Regulation E-Delivery on July 16. The proposal would allow issuers, broker-dealers, investment advisers and other regulated firms to deliver many required documents electronically without first obtaining each investor’s affirmative consent. (The SEC Wants to Make Paper Disclosures the Opt-In)

The proposal covers materials including prospectuses, shareholder reports, proxy documents, trade confirmations, Form CRS relationship summaries and investment-adviser brochures. People receiving paper would get two mailed transition notices and could continue requesting printed documents.

If adopted and widely used, the rule could move financial disclosure from a postage operation to an auditable digital workflow. It would reduce printing costs, but also force decisions about broken links, outdated contact details, accessibility, cybersecurity, retention and what counts as successful delivery.

Failure will not look like a rejected email alone. It will look like investors unable to retrieve documents, firms lacking evidence of delivery, or large numbers of people opting back into paper. The comment deadline remains active and will fall 60 days after the proposal appears in the Federal Register.

X has six months to make its data available for real scrutiny. The European Commission accepted X’s Digital Services Act compliance plan on July 16. X must improve its advertising archive, provide access through an application programming interface, speed up researcher applications and revise contractual terms that restrict lawful scraping. (X Gets Six Months to Make Its Black Box Less Black)

Eligible researchers are also supposed to receive free access to public data. If the plan works, researchers could analyze political advertising and platform behavior systematically instead of assembling evidence one screen at a time.

But acceptance was not absolution. The European Board for Digital Services considered the plan only partially adequate, particularly on auditing, and the Commission added implementation clarifications before approving it.

X now has six months to implement the plan and must submit an independent audit afterward. Success means researchers receive useful data at meaningful scale; failure means an impressive-looking portal with slow approvals, brittle tools or fields too incomplete to support real scrutiny. (X Gets Six Months to Make Its Black Box Less Black)

A chatbot wearing a name tag, Google handing rivals a wrench for Android’s pipes, and Anthropic leaving court with a $1.5 billion library receipt: regulation has rarely looked so much like prop comedy.

Meanwhile, the Nuclear Regulatory Commission has written 157 pages explaining why the data center’s “simple” power plan may require several binders and a very patient reactor.

Keep the metadata.

Forward this to the person who still thinks AI compliance is a terms-of-service update. (X Gets Six Months to Make Its Black Box Less Black)