Weekly AI Governance Brief: 2–8 November 2026
Bringing you the latest developments in the AI governance world.
EU Advocate General addresses copyright liability for generative AI answers
On 3 November, First Advocate General Maciej Szpunar delivered an Opinion in Case C-250/25, Like Company, concerning the application of EU copyright law to generative AI systems that retrieve and reuse online press publications. The case arises from proceedings brought by a Hungarian publisher against Google in relation to its Gemini chatbot. It examines whether the chatbot's use of published material constitutes reproduction or communication to the public under EU law.
The dispute involves Gemini's use of retrieval-augmented generation, which allows a chatbot to obtain information from online sources when preparing responses to user queries. Like Company argued that Gemini had used its articles without authorisation, including through model training and by generating responses based on its publications. The Hungarian court referred questions concerning the relevant rights of press publishers to the Court of Justice.
The Advocate General proposed a distinction between the use of material for training and the use of protected content in chatbot-generated answers. He recommended that the Court declare the training-related questions inadmissible because there was no evidence establishing that the publisher's articles had been used to train Gemini. For completeness, he also expressed the view that model training using protected works is generally permitted under the EU text-and-data-mining exception, subject to the applicable legal conditions.
The Opinion takes a different approach to the chatbot's retrieval and presentation of published content. The Advocate General considered that infringement may arise where a chatbot circumvents effective technical restrictions on accessing a publication or reproduces its protected expression in a recognisable form. He distinguished such expression from the underlying facts reported in news articles, which are not themselves protected by the press publishers' right.
UK government proposes statutory framework for facial recognition oversight
On 4 November, the UK Home Office published its response to a public consultation concerning a new legal framework for law enforcement use of biometrics, facial recognition and similar technologies. The government confirmed its intention to introduce legislation establishing specific powers and obligations for authorised users, alongside a new independent oversight body.
The proposed framework is intended to replace the current reliance on legal requirements distributed across several existing instruments with a more clearly defined statutory structure. The government's response addresses the circumstances in which facial recognition may be used, the safeguards required to protect individual rights and the responsibilities of public authorities deploying these technologies.
A central element is the proposed creation of an independent regulator with powers to monitor compliance and enforce standards. The Home Office indicated that serious failures could result in enforcement proceedings, including applications for court injunctions preventing the use of relevant technologies. The regulator would also advise on technical standards and emerging risks.
The government further committed to independent testing of technologies for potential bias and discrimination. It intends to introduce a legal code of practice governing police use and develop a separate code for private-sector facial recognition used for crime prevention. The proposals include an emphasis on intelligence-led and proportionate deployment, rather than unrestricted use in public spaces.
US banking regulator adopts a technology-neutral approach to AI supervision
On 4 November, the US Office of the Comptroller of the Currency issued Bulletin 2026-54, introducing a supervisory framework for examiners assessing banks' use of advanced AI technologies. The agency uses the term super intelligence to encompass AI systems and their developing capabilities, including applications involving autonomous agents.
The framework is designed to assist OCC examiners in evaluating AI use within ordinary banking activities. It directs attention towards the materiality of individual applications and the consequences of potential failure or misuse. The OCC also identifies the transfer of agency to automated systems and the degree of human oversight as relevant considerations when assessing risk.
A central feature is the regulator's rejection of AI as a separate and distinct risk category. The OCC states that examiners should consider AI within existing supervisory practices covering governance, model risk management, technology and operational risk. Banks are not required to establish a separate AI risk appetite solely because they use advanced AI technologies.
The framework also emphasises proportionality. Examinations should reflect an institution's size, complexity and risk profile, while the intensity of controls may be considered in relation to the potential consequences of an AI application. An automated system with significant decision-making authority may therefore warrant closer supervisory attention even where its underlying technology is not especially sophisticated.
The OCC explicitly states that the framework does not establish new regulatory expectations or enforceable standards for banks. It is an internal supervisory resource intended to support examiner judgment.
European Commission makes progress against TikTok's recommendation system
On 6 November, the European Commission issued preliminary findings that TikTok had breached the Digital Services Act in relation to the operation of its For You recommendation system. The findings concern what the Commission describes as the rabbit hole effect, whereby repeated interaction with particular categories of content can lead to increasingly similar algorithmic recommendations.
The Commission identified concerns about the repeated presentation of material involving mental health struggles and body image. Its preliminary assessment is that continuous exposure to such content may have detrimental effects on users, particularly minors and vulnerable adults.
The findings focus on TikTok's assessment of systemic risks and the effectiveness of measures intended to mitigate them. The Commission is examining the consequences of the recommendation system's design, rather than treating individual items of content as the sole source of potential harm.
The action represents a substantive procedural step in the Commission's supervision of TikTok under the DSA. It is not a final infringement decision, and the preliminary findings remain subject to the applicable enforcement procedure.
Sources
CJEU, Advocate General's Opinion in Case C-250/25, Like Company, Press Release No 155/26: https://curia.europa.eu/site/upload/docs/application/pdf/2026-11/cp260155en.pdf
UK Home Office, government response to consultation on law enforcement use of biometrics and facial recognition: https://www.gov.uk/government/consultations/legal-framework-for-using-facial-recognition-in-law-enforcement/outcome/new-legal-framework-for-law-enforcement-use-of-biometrics-facial-recognition-and-similar-technologies-government-response-to-the-consultation-acces
UK Home Office, announcement of proposed facial recognition safeguards: https://www.gov.uk/government/news/stronger-laws-for-police-using-facial-recognition-technology
US Office of the Comptroller of the Currency, Bulletin 2026-54, Super Intelligence: Supervisory Framework: https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-54.html
European Commission, preliminary DSA findings concerning TikTok's For You recommendation system: https://digital-strategy.ec.europa.eu/en/news/commission-preliminarily-finds-tiktoks-you-feed-breach-digital-services-act-harmful-rabbit-holes