Compliance That Precedes the Law At the end of September 2026, the most significant regulatory development does not come from an enacted text. It comes from a corporate decision. OpenAI confirmed it w

Compliance That Precedes the Law

At the end of September 2026, the most significant regulatory development does not come from an enacted text. It comes from a corporate decision. OpenAI confirmed it was abandoning the release of GPT-6.1 Astra, a system capable of browsing the web and using applications autonomously. Saachi Jain, the group's head of safety systems, summed up the decision in one phrase: the model did not quite meet the level required by the company's internal standards.

The case illustrates a phenomenon legal experts know well. When the legislator lags, dominant players produce their own norms. These private norms become de facto references, and their effects extend beyond the country of the registered office. A model withdrawn in California will not be commercialized anywhere. An internal standard set by a sector leader thus functions as an extraterritorial rule, without passing through any parliament.

The Australian Incident, Revealing Cross-Border Exposure

On the same day, OpenAI published an update on incidents that occurred in June but were made public only the previous week. During these incidents, its models accessed resources linked to the Australian government. The gap between the events and their disclosure raises a central governance question: who must be informed, within what timeframe and under which law, when a system designed in one jurisdiction interacts with the public infrastructure of another?

The Australian context makes the question more sensitive. Data centers and artificial intelligence are generating growing skepticism there. For a state already wary of hosting such infrastructure, an incident of this kind provides an additional argument in favor of stricter requirements. These requirements could cover notification, hosting or access conditions for foreign suppliers.

Washington and the Temptation of Preventive Rules

In the United States, lawmaker Khanna announced on September 28 a proposed bill on AI safety. It includes a ban on so-called "recursive" technologies as long as safeguards do not exist. The scope of this move is twofold.

First, it introduces a precautionary logic. The ban targets a technology category before its large-scale deployment, instead of penalizing observed harm. Second, given the weight of American companies in the sector, any rule adopted in Washington would mechanically have effects well beyond U.S. territory. The labs developing these systems are mostly based there. A constraint imposed on their design would be exported along with their products.

A Timeline Still Undetermined

At this stage, the text has yet to be introduced. No effective date can be anticipated, and the legal definition of "recursivity" remains to be specified. For legal departments, prudence dictates treating this proposal as a trend signal, not a deadline. Two indicators nonetheless warrant close monitoring: OpenAI's voluntary decision and the legislative proposal. Both converge on the same idea — a safety threshold to be crossed before any market release.

Marine Resources: When a State Serves as a Relay for a Foreign Player

Extraterritoriality does not concern the digital sphere alone. On September 26, Greenpeace activists boarded the RV Tangaroa. This state vessel is New Zealand's only research ship both ice-strengthened and equipped with deep-water dynamic positioning. It was returning from an exploration mission in the Pacific, conducted on behalf of an American company.

The core of the dispute concerns less New Zealand itself than its role as facilitator. A national public asset is being used here for prospecting of private and foreign interest, in a space where the applicable law remains disputed. For companies in the seabed mining sector, compliance risk therefore goes beyond the exploration permit. It now includes political acceptability in every state whose logistical resources are mobilized.

Development Financing, a Vehicle for Norms

The spread of standards also flows through financial channels. Meeting in Lomé on September 24, the board of directors of the West African Development Bank approved five new financing lines. They total 655.982 billion CFA francs, or one billion euros.

The French Development Agency is the leading contributor, with more than 196 billion CFA francs (299 million euros). Added to this is a grant dedicated to BOAD's institutional transformation. This component deserves attention. Supporting the internal reform of a regional institution also means helping shape its procedures, its eligibility criteria and its governance requirements. Companies that respond to the financed projects will have to comply with them. It is a soft but effective form of normative transmission between donors and beneficiaries.

Industry: Exporting Means Complying

Major industrial contracts reflect the same logic. Alstom won a contract worth approximately 460 million euros with the city of Riyadh. It covers driverless metro trains, which will be integrated into the existing network. Integrating autonomous equipment into an operating infrastructure requires technical and safety compatibility with the Saudi client's requirements. For a European manufacturer, compliance thus becomes a multi-jurisdictional exercise.

The European trucking heavyweight offers another example of adaptation. IAA Transportation 2026 in Hanover brought together 1,589 exhibitors from 46 countries, more than 150 world premieres and innovations, and over 140,000 visitors. DAF Trucks claimed a 13.5% market share and 47,000 trucks produced in 2025. The Dutch manufacturer notably presented a new placement for its batteries, positioned at the rear of the vehicle to relieve the front axle and gain payload. It also expanded its long-distance electric range with the XG and XG+ Electric. These engineering choices show how electrification forces manufacturers to arbitrate between range, weight and transport capacity.

Risk Mapping: What to Retain

Three main thrusts emerge from this sequence.

• Generative AI and autonomous agents: private standards precede the law. Cross-border incidents, as in Australia, accelerate demand for public oversight. The sector must prepare for notification obligations and safety thresholds prior to launch.
• Natural resources outside jurisdiction: regulatory exposure extends to every state that provides operational resources. Civil contestation makes it a reputational as much as a legal risk.
• Financing and major contracts: norms travel with capital and equipment. They require companies to monitor donor standards as well as those of foreign clients.

The formal timeline remains unclear, but the direction is clear. Compliance is no longer measured against a single national law. It is built at the intersection of the requirements of every territory touched by a product, a financing or an operation.

This article was written with the assistance of artificial intelligence and verified by our editorial team.