The Lyceum: Tech Policy & Regulation Weekly — May 08, 2026

This was a week where the legal scaffolding under several of the year's biggest policy bets cracked at once. A federal trade court struck down the administration's backup 10% global tariffs on Thursday — the second judicial rejection of the tariff program in three months — even as the administration's USTR investigations into overproduction and forced labor were already drafting the legal foundation for a third-generation tariff regime. Meanwhile, Brussels finally put real implementation dates on the EU AI Act, FDA opened a new front against compounded GLP-1s, and the FTC made clear that "anonymous" location data isn't anonymous enough to sell.

If your EU AI compliance plan was built around a tidy 2026 deadline, Wednesday's news rearranged the furniture. The European Commission announced that Parliament and Council reached a political agreement on the "Digital Omnibus on AI" — a simplification package that pushes back when the hardest parts of the AI Act actually bite. High-risk systems used in biometrics, critical infrastructure, education, employment, migration, asylum, and border control would now apply from December 2, 2027. AI embedded in regulated products like lifts and toys would apply from August 2, 2028. The package also adds a flat ban on "nudification" apps — the genre of generative tools designed to fabricate non-consensual nude imagery.

This is not "the AI Act is delayed." It's targeted sequencing — the Commission's framing is that standards and support tools should exist before obligations attach. But the practical effect for medtech, robotics, industrial automation, HR-tech, and border-tech vendors is meaningful runway, and the question is whether companies use it to clean up documentation or to slow-walk programs they should be hardening now. Watch the formal legal text and publication steps before treating every detail as locked. The compliance clock changed; it didn't disappear.

The signal that tells you which way this goes: whether the Commission pairs the extended timetable with sharper enforcement guidance for the obligations that do hit in August 2026. If yes, the runway is real. If not, expect another omnibus next year.

A 2-1 panel of the U.S. Court of International Trade ruled Thursday that the administration's replacement global 10% tariffs are unlawful, finding the administration had misread the Trade Act of 1974 — a statute that authorizes tariffs only in response to large and persistent balance-of-payments deficits, a condition the court said does not currently exist. This is the second judicial rejection of the tariff program in three months, following the Supreme Court's February ruling that knocked out the first version.

The injunction itself is narrow: it directly blocks collection only for the three plaintiffs (the state of Washington and two small businesses). For everyone else, the practical situation is uglier than the headlines suggest. Per NPR's reporting, customs brokers report that Customs and Border Protection has not changed assessments in the Automated Commercial Environment for most importers — meaning companies are still being assessed the 10% duty at the port and forced to either pay or post large single-transaction bonds while DOJ pursues emergency appellate relief. Public reporting via Axios puts potential refund exposure from the earlier struck round at roughly $166 billion.

The part most coverage missed: the administration isn't waiting on appeals. USTR is running two parallel investigations — one into overproduction by 16 trading partners including the EU, China, and Japan, and one into forced-labor practices across 60 economies covering 99% of U.S. imports. Both are legal scaffolding for a third-generation tariff regime built on a different statutory foundation. The chip and pharma carve-outs that survived rounds one and two were negotiated into specific proclamations — they don't automatically port to whatever vehicle comes next.

What to watch: a Federal Circuit stay motion in the next two weeks, and how quickly USTR moves the overproduction investigation toward findings.

Most readers see "interoperability proceeding" and stop. Don't. The European Commission's April 27 consultation on Android interoperability under the Digital Markets Act is, in plain English, a fight over whether Google must open Android's plumbing — defaults, invocation layers, system permissions, device features — to rival services, including AI assistants. The Commission's own materials explicitly note that AI services are becoming central to mobile use. Comments are due May 13, 2026 — Wednesday.

If rival assistants gain deeper Android access at the OS level, the distribution economics for mobile AI shift fast. Defaults decide which assistant most users actually touch; invocation layers decide whether you're holding down a button to talk to Gemini, ChatGPT, or Claude. The success signal is whether the final specification goes beyond narrow technical access into how gatekeepers must accommodate competing AI agents at the operating-system level. Failure looks like a thin technical annex that lets Google check the box without changing distribution. Platform regulation is now AI market-structure regulation.

While executive-branch chip policy has been in flux all year, the House Foreign Affairs Committee has scheduled a May 13 markup that includes the Chip Security Act and related export-control measures. The Chip Security Act would add criminal enforcement to the existing civil export-control regime targeting smuggling of advanced chips — meaning prosecutors, not just BIS attorneys, would have a tool against diversion networks.

A statutory framework is much harder to reverse than an executive rule, which is the whole point. If the committee advances the text, exporters, distributors, and freight handlers face a different kind of compliance program: one where front-line employees may need actual training on red flags, because the downside is no longer just civil penalties and license denials. The signal that tells you this is real: whether the markup produces clean text or gets bogged down in amendments over scope and intent standards.

FDA proposed to exclude semaglutide, tirzepatide, and liraglutide from the 503B bulks list, finding no clinical need for outsourcing facilities to compound these drugs from bulk substances. The mechanics matter: 503B outsourcing facilities generally cannot compound from bulk drug substances unless the ingredient is on that list or the product is on FDA's shortage list. Comments are due June 29, 2026.

This is a proposed determination, not a final ban. But it gives FDA a cleaner legal path to keep tightening the lane for mass-market GLP-1 compounding even when companies pivot from "shortage" arguments to "clinical need" arguments. It lands on top of FDA's earlier warning letters this year over compounded semaglutide and tirzepatide manufacturing practices, and on top of the agency's ongoing rulemaking on deceptive drug advertising aimed squarely at telehealth and compounders. FDA isn't policing the hallway anymore — it's closing the side door.

What to watch: whether brand manufacturers, telehealth platforms, and compounders pile coordinated comments into the docket before June 29. If they do, this becomes formal administrative trench warfare. If they don't, FDA finalizes with a much freer hand.

A lot of data businesses still talk about location data as if stripping the names off makes it harmless. The Federal Trade Commission spent this week saying otherwise. The FTC's privacy enforcement page now lists a May 4, 2026 settlement banning Kochava and a subsidiary from selling sensitive location data tied to millions of mobile devices. The Kochava case has been the clearest federal test of whether precise geolocation can be treated as sensitive even when brokers insist it's pseudonymous, aggregated, or merely device-level.

For AI and platform companies, this is bigger than ad-tech. Location data feeds fraud models, mobility analysis, audience profiling, and increasingly model training and fine-tuning. The settlement posture tells the market the FTC views certain categories of commercial brokerage as inherently dangerous, not just sloppily disclosed. "De-identified" is not a magic invisibility cloak. The signal to watch: whether state attorneys general use the Kochava theory as a template. New York's surveillance pricing package and California's parallel work both rhyme with it.

EPA's updated 2026 interim guidance on destroying and disposing of PFAS-containing materials offers recommendations, a new technology evaluation framework, and discussion of currently used disposal routes. EPA is explicit: the document does not establish requirements. That point is critical — this is guidance, not a final rule.

But "nonbinding" is not the same as "unimportant." Companies handling PFAS waste, contaminated media, or PFAS-containing products now have a fresh EPA document that plaintiffs, state regulators, and counterparties will absolutely wave around when arguing what responsible management should have looked like in 2026. Soft law has a habit of showing up in hard litigation as the standard of care. Watch whether EPA follows with prescriptive rulemaking — or whether states move first with their own permitting conditions, which is the more likely path given the federal slowdown.

A Brussels deadline for nudification apps, a trade court rejecting tariffs that the customs computer hasn't been told about yet, and an Indian Supreme Court justice reading aloud the names of cases that don't exist. Somewhere a compliance officer is updating a tracker that has three different "deadlines" for the same PFAS rule, none of them real. Until next week.

Forward this to the GC who's been asking you what the AI Act timeline actually is — they need the December 2027 date.