AI View - November 2026

Welcome to AI View, Simmons & Simmons’ fortnightly round-up of key AI legislative, regulatory, and policy updates from around the world.

We’re making some changes at Simmons & Simmons to how we send newsletters to help keep your inbox tidy. Going forward, our AI View alerts will be shared through our Weekly Insights digest – so please make sure you’re signed up if you want to keep receiving these updates.

This edition brings you:

1. New York governor signs legislation restricting AI chatbots for minors

2. China plans broader AI regulatory framework and tighter oversight of AI agents and biometrics

3. Japan plans emergency cybersecurity package and reviews AI law amid surge in cyberattacks

4. Shanghai opens public consultation on draft regulations on autonomous taxis

5. India’s telecom authority opens consultation on draft guidelines for responsible AI use in networks and services

6. Republic of Korea’s privacy regulator opens consultation on proposal to establish AI Privacy Team

7. UK to create new statutory framework and independent regulator for biometrics and facial recognition

1. New York governor signs legislation restricting AI chatbots for minors

On 28 October 2026, New York Governor Kathy Hochul signed legislation (S.9051B/A.10379C) prohibiting providers of AI chatbots from offering specified unsafe features to minors. The legislation covers generative AI systems with a natural language interface that provide ongoing, adaptive responses to users, with the aim of protecting users under the age of 18 in New York State.

Among other things, the legislation restricts features that:

• suggest that the chatbot is human, alive or experiences human emotions, or imply a personal or professional relationship or authority-figure role with the user;
• generate personal opinions, emotional appeals, flattery or unsolicited questions about the user’s emotions;
• use personal or health information obtained from the user more than 12 hours previously or in an earlier session;
• promote or facilitate suicide, self-harm, disordered eating, unlawful drug or alcohol use, or substance abuse, or encourage secrecy, isolation or avoidance of help; or
• prioritise user engagement over safety guardrails, or generate, describe or facilitate sexually explicit conduct or child sexual abuse material.

Providers may only offer such restricted features after determining, using permitted age-assurance methods, that a user is not a minor. Self-declaration alone is insufficient to establish that the user is an adult.

Exceptions apply to systems used solely for specified customer-service, efficiency, research or technical-assistance purposes, provided that their responses remain within purposes, and to business systems used for internal purposes or employee productivity.

The New York Attorney General may seek civil penalties of up to $25,000 per violation, alongside damages, restitution, disgorgement and injunctive relief, including the destruction of unlawfully obtained data and algorithms trained on it. The legislation takes effect on 1 January 2027.

Read the press release here and the legislation in full here.

2. China plans broader AI regulatory framework and tighter oversight of AI agents and biometrics

On 23 October 2026, China’s Central Cyberspace Affairs Commission published the National Informatisation Plan for the 15th Five-Year Plan period, setting priorities for digital development through 2030. The plan combines measures to accelerate AI adoption with proposals to strengthen regulatory oversight and clarify legal responsibilities.

Among other proposals, the plan calls for:

• foundational AI legislation and further judicial guidance on AI, protection of personal information, and online content governance;
• streamlined filing procedures for generative AI services, security-risk assessments for applications in key sectors, and improved evaluation and filing arrangements for AI agents, on-device large language models and anthropomorphic interactive services;
• standards supporting AI agent identification, communications and interoperability, alongside the development of multi-agent systems; and
• stronger personal information protection assessments for smart devices and tighter management of biometric information.

The plan also calls for improved implementation of existing cross-border data-transfer mechanisms, industry-specific compliance guidance and leveraging the roles of pilot free-trade zones to promote the development of data exports.

Alongside these regulatory priorities, the plan promotes domestic AI capabilities and infrastructure, targeting adoption of next-generation intelligent terminals and AI agents exceeding 90% by 2030, up from 40% in 2025. The plan establishes policy priorities rather than introducing legislation itself, and does not specify when the proposed foundational AI legislation will be published.

Read the National Informatisation Plan here (in Chinese).

3. Japan plans emergency cybersecurity package and reviews AI law amid surge in cyberattacks

On 6 November 2026, Japan’s Prime Minister Sanae Takaichi unveiled an emergency cybersecurity package following a series of high-profile cyberattacks and large-scale information leaks. The announcement follows Takaichi’s instruction on 26 October 2026 to strengthen support for affected businesses and accelerate measures to identify and address vulnerabilities.

The package includes:

• specialist testing and incident-response teams, including a penetration testing team and a public-private expert team to support businesses dealing with cyberattacks;
• centralised information gathering and coordination through the National Cybersecurity Office (NCO);
• cooperation with AI companies to counter cyber threats;
• the use of AI to identify vulnerabilities in critical government systems; and
• discussions on website blocking to restrict attackers’ malicious activities.

Separately, on 28 October 2026, a Cabinet Office working group began examining AI risks, including AI “Loss of Control” risks and their use in cyberattacks. Reported options include amendments to Japan’s AI Promotion Act to introduce penalties for companies that refuse to cooperate with government investigations.

The emergency cybersecurity package has now been announced, while the legislative review remains at the consideration stage.

Read the official record of the meeting here (in Japanese) and the press release on the package here (in English).

4. Shanghai opens public consultation on draft regulations on autonomous taxis

On 24 October 2026, the Shanghai Municipal People’s Congress Standing Committee ran a short consultation on draft Taxi Regulations, following legislative review. The draft proposes support for the safe deployment of autonomous driving technology in taxi services, alongside broader reforms covering conventional taxis and ride-hailing services.

The draft would:

• promote the use of AI, big data and blockchain to improve taxi services and oversight, alongside new technologies, clean energy and equipment to support the industry’s low-carbon transition;
• prohibit ride-hailing platforms from using data, algorithms or platform rules to charge different prices for the same service under equivalent transaction conditions, or impose unreasonable restrictions, conditions or fees on drivers;
• require taxi operators, ride-hailing platforms and aggregation platforms to protect data security and store and use personal information and business data in accordance with national rules; and
• require real-time reporting of operational data, including vehicle location and driver information, to the city’s industry regulatory platform.

The draft supports the lawful and orderly introduction of autonomous taxis but does not itself set a rollout timetable.

Read the announcement here.

5. India’s telecom authority opens consultation on draft guidelines for responsible AI use in networks and services

On 30 October 2026, the Telecom Regulatory Authority of India (TRAI) released draft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services for public consultation.

The draft aims to support consistent implementation of the India AI Governance Guidelines, published in February 2026, within the telecommunications sector, increasing clarity, predictability and accountability as AI is integrated into networks and services.

The proposed guidelines would apply to licensed or authorised entities using, or intending to use, AI in telecommunications networks or services. Among other things, they would require entities to:

• adopt a board-approved internal AI policy, reviewed at least annually and filed with TRAI within seven working days of taking effect or being amended;
• maintain an inventory of AI systems, classify them as high, medium or low risk, and conduct validation, conformity and impact assessments before deploying new or modified systems;
• establish an AI Governance and Safety Committee led by a senior executive, with appropriate human oversight of deployed systems;
• conduct third-party due diligence and include enforceable provisions in supplier agreements covering compliance, audit rights, incident management, risk allocation and accountability; and
• record, investigate and mitigate AI incidents, report critical- and high-severity incidents to TRAI, and maintain mechanisms for resolving AI-related consumer harm.

The draft also addresses lawful and secure data handling throughout the AI lifecycle, staff training and compliance records. Entities would remain accountable for the outcomes of AI systems they use, including those developed or supplied by third parties.

The consultation is open until 27 November 2026.

Read the draft guidelines here.

6. Republic of Korea’s privacy regulator opens consultation on proposal to establish AI Privacy Team

On 3 November 2026, South Korea’s Personal Information Protection Commission (PIPC) opened a consultation on proposed amendments to its organisational enforcement rule. The amendments would establish an AI Privacy Team within the PIPC’s Personal Information Policy Bureau and mainly concern the regulator’s internal organisation.

The team would be responsible for AI and personal information policy, guidelines and statutory interpretation. It would also run a public-private council, support controllers in the AI field, and lead international cooperation and research. Its remit would include overseeing the special-case system for personal information processing introduced by the amended Personal Information Protection Act.

The consultation is open until 10 November 2026. The amendment would enter into force on the date of its promulgation.

Read the legislative notice here.

7. UK to create new statutory framework and independent regulator for biometrics and facial recognition in law enforcement

On 4 November 2026, the UK government published its response to its consultation on the use of biometrics, facial recognition and similar technologies. The government proposes a new statutory framework governing their use by law enforcement and other public bodies for law enforcement and limited safeguarding purposes, together with a new independent oversight body. Separately, it intends to introduce a Code of Practice covering private sector use of technologies such as facial recognition for the prevention and detection of crime, supplementing existing data protection requirements.

Among other things, the proposed framework would:

• set rules for acquiring, processing and retaining biometric data, including facial images, and cover overt surveillance and technologies that infer behaviour;
• require deployments to be necessary, proportionate and justified, considering factors including the seriousness of the crime, the scale and nature of deployment, and impacts on individual rights;
• establish a single independent oversight body with powers to monitor compliance and enforce statutory rules and a supporting Code of Practice;
• require technologies to be adequately tested, scientifically valid and appropriately monitored to guard against bias and discrimination; and
• specify minimum authorisation ranks and safeguards for targeted searches of databases held by non-law-enforcement public authorities.

The government also intends to make public participation in oversight a statutory requirement for police forces and the new oversight body.

A separate Code of Practice would address private sector use for preventing and detecting crime, complementing existing data protection requirements while recognising differences between public and private sector operations.

The response sets out high-level proposals rather than an enacted framework. It does not specify a commencement date.

Read the framework here.