Frontier AI rules and your AI program

Three sets of rules aim at the companies that build the most capable AI models: California's Transparency in Frontier Artificial Intelligence Act (SB 53), the EU AI Act's rules for general-purpose AI models, and a federal framework that Anthropic proposed in June 2026. They place duties on those developers, not on the organizations that use their models. If your organization uses AI, they reach you mostly through the information developers must now publish or pass on to you, and that information is useful evidence for your own program.

Who these rules apply to

California SB 53 (in force since 1 January 2026)

Signed on 29 September 2025. A frontier developer is a person that has trained, or begun training, a foundation model using more than 10²⁶ computing operations. Every frontier developer must publish a transparency report when it deploys a new or substantially modified frontier model (it may form part of a system card) and report critical safety incidents to the California Office of Emergency Services within 15 days of discovering them, or within 24 hours to an appropriate authority where an incident poses an imminent risk of death or serious physical injury. A large frontier developer (more than $500 million in annual gross revenue, with its affiliates, in the preceding calendar year) must also publish a frontier AI framework, review it at least once a year, and send the Office of Emergency Services a summary of its internal-use catastrophic risk assessments every three months, or on another reasonable schedule it sets and communicates. Employees who report catastrophic risks are protected, and only the Attorney General can seek civil penalties of up to $1 million per violation.

EU AI Act: general-purpose AI models (Arts. 53 and 55)

Every provider of a general-purpose AI model must keep technical documentation for the authorities, give the providers who integrate the model into their own AI systems the information they need to understand its capabilities and limitations (Art. 53(1)(b) and Annex XII), adopt a copyright policy, and publish a summary of the content used for training. A model is presumed to carry systemic risk when its training used more than 10²⁵ floating-point operations (Art. 51(2)); its provider must also evaluate it, including adversarial testing, assess and mitigate systemic risks, report serious incidents to the AI Office without undue delay, and protect its cybersecurity (Art. 55).

EU AI Act: the dates

These obligations apply since 2 August 2025 (Art. 113). The Commission's enforcement powers apply from 2 August 2026: it can request information and access to a model, require measures, ask a provider to restrict, withdraw or recall a model (Art. 93), and fine up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher (Art. 101). Models placed on the market before 2 August 2025 must comply by 2 August 2027 (Art. 111(3)).

The General-Purpose AI Code of Practice

A voluntary code the Commission received on 10 July 2025. It has three chapters: Transparency and Copyright, for every provider, and Safety and Security, for the few providers of the most advanced models. The Transparency chapter includes a Model Documentation Form. Providers that sign it can rely on it to show they meet Arts. 53 and 55 until a harmonised standard is published (Arts. 53(4) and 55(2)).

Anthropic's Advanced AI Framework (a proposal, not law)

A policy proposal published in June 2026, written mainly for the US federal government. It would cover developers that train models with more than 10²⁵ operations and either earn more than $500 million a year in AI revenue or spend more than $1 billion a year on AI research and development. They would publish a safety framework and certify compliance with it every year, publish a system card for each covered model release or major new capability and a risk report at least every six months, report critical safety incidents to a federal agency within 15 days, and engage an independent evaluator. It creates no duty today.

What they mean if your organization uses AI

An organization that uses AI models built by others is very unlikely to meet these thresholds. The rules still matter to it, because they make the developers of the models it relies on publish or hand over information it can use.

Published documents you can ask for and keep

A frontier AI framework and a transparency report or system card for each frontier model (California), the public training-content summary and the provider's copyright policy (EU), and whether the provider has signed the Code of Practice. Each tells you something about intended uses, restrictions on use and known risks that belongs in your own risk assessment and vendor review.

Documentation passed downstream

If you build a general-purpose model into an AI system that you provide, including one you put into service for your own use, you are a downstream provider under the EU AI Act (Art. 3(68)) and the model's provider must give you the information in Art. 53(1)(b) and Annex XII. If you change a model substantially, check whether you become its provider; the Commission's guidelines for providers of general-purpose AI models explain who is in scope. The AI Office also runs a channel for downstream providers to report suspected infringements by model providers.

Incidents you should hear about

A critical safety incident at a model's developer may affect the systems you run on that model. Members of the public can also report such incidents to the California Office of Emergency Services. Treat a provider's incident disclosure as a trigger to review the systems that depend on it.

How AI Sentinel helps

AI Sentinel does not add SB 53 or Anthropic's proposal as frameworks, because neither places duties on an organization that uses AI. It gives you places to keep what the developers publish, next to the frameworks it does map: the EU AI Act, the GDPR, the NIST AI RMF, ISO/IEC 42001, AIUC-1 and the California, Colorado, Texas and Washington rules.

Vendors and vendor reviews

Record each model developer as a vendor, link it to the systems that use it, and run a vendor assessment with findings and a next review date. Note in the findings which disclosures the developer has published and whether it has signed the Code of Practice. A vendor added from the catalog brings its trust center link, certifications and frameworks with it.

The model behind each system

In the AI registry, each system lists the models it uses, with provider, version, a training data summary and known limitations. Take these from the provider's system card or model documentation, and export them with the model inventory report.

Evidence

Attach a provider's published document as an evidence item, with its link and a description, to the requirements you map in Compliance. The EU AI Act framework includes the Art. 53 requirements on technical documentation, information for downstream providers, the copyright policy and the training content summary.

Incidents, oversight and the calendar

Log a provider's incident disclosure as an incident on each affected system, with its timeline, and use an oversight gate for the decision to adopt or upgrade a model. Once you declare the relevant jurisdictions, the obligations calendar shows the EU general-purpose AI milestone and the California SB 53 milestone as context.

Information, not legal advice

This page summarizes the rules as published in the sources below, read on 26 October 2026. It is information, not legal advice, and it does not decide whether a rule applies to your organization. Anthropic's framework is a proposal: it may change, and it may never become law.

Sources

Go to vendors