AI Regulation & Policy

Today's Stories

1. 1

   RIZAP employee leaks 210 IHI health-insurance records to AI, OpenAI notified

   RIZAP Group said an employee mistakenly uploaded personal data, including names and disease details of 210 people covered by IHI's health insurance, to a generative AI for personal use. This marks a shift from internal data-handling policies to a real incident involving health information, which is highly sensitive. RIZAP publicly disclosed the breach to OpenAI, signaling a new level of accountability.

   How RIZAP and IHI respond to affected individuals and regulators. The number of affected people (210) is a concrete figure to monitor for any updates.

2. 2

   SoftBank earns ISO/IEC 42001:2023 for TASUKI Annotation

   SoftBank obtained ISO/IEC 42001:2023 certification on August 25, 2026 (UK time) for the AI management system of its data preparation service 'TASUKI Annotation'. The certifying body was BSI Assurance UK Limited. This certification marks SoftBank's formal recognition for managing AI risks under an international standard. It shifts the company from internal policies to a third-party-verified governance framework, supporting its 'Activate AI for Society' growth strategy.

   SoftBank plans to apply insights from this certification to improve AI governance and pursue certification for other products and services. The effective management of AI-related risks, data quality, and transparency will determine the broader impact.

3. 3

   BSI awards SoftBank ISO/IEC 42001:2023 for TASUKI Annotation

   BSI Group Japan certified SoftBank's AI management system for its data-preparation service 'TASUKI Annotation' under the international standard ISO/IEC 42001:2023, effective August 25, 2026. This certification, issued after audits by BSI Japan and review by BSI Assurance UK, marks SoftBank's AI governance as meeting international requirements, a contrast to BSI's survey finding that only 10% of Japanese firms have AI governance programs.

   The certification hinges on SoftBank continuously evaluating and improving risks and opportunities in its AI management system; its value for customers and partners will depend on how SoftBank maintains this standard in practice.

4. 4

   Meta ads nudified real teens; TTP found CSAM

   TTP found ads on Meta that nudify real teens, including a CSAM ad from a page claiming to represent the Church of Jesus Christ of Latter-day Saints. Meta disabled the page only after TTP flagged it. Meta's delayed response allowed ads to reach over 29,000 people in the EU and 6,800 in the UK, with about 80% served in the US. Attorneys general in Michigan and Florida are now looking into the issue.

   Meta's response to Senator Warner's letter and the Australian eSafety regulator's request for information will determine next steps. Watch whether Meta takes clearer action to stop these ads.

5. 5

   Lawsuit: Anthropic's Max plan overpromises usage

   A group of Claude subscribers filed an expanded class action lawsuit today, alleging Anthropic deceptively advertised the limits of its Max subscription tier. The Max plan promises '5x' or '20x' usage, but the fine print limits these to five-hour sessions with weekly caps, which plaintiffs say adds up to far less than advertised.

   The case hinges on whether the court finds clicking hyperlinks to reveal session limits is sufficient disclosure, or if it's a 'buyer beware' approach that misleads consumers.

6. 6

   SoftBank, Kirin, Lawson cut hiring time with AI agents

   SoftBank introduced an AI system for video interview screening in May 2020, cutting screening time by about 70%. Kirin Holdings and Lawson use AI interviewers, with Lawson seeing offer acceptance rise about 10%. These tools replace manual hiring steps, but the article stresses avoiding discrimination and legal issues. AI outputs are used as pass filters, with humans reviewing all failures, a pattern that balances speed and safety.

   EU AI Act obligations for high-risk AI start December 2, 2027. The EU AI Act classifies recruitment AI as high-risk, so firms with EU operations must prepare recording systems.