Q3 2026 compliance and remediation update

Changing seasons: The evolution of AI regulation

As I write this edition of Turnberry’s compliance and remediation update, summer has given way to autumn. The days are getting shorter, temperatures are cooling, and leaves are changing color. It’s a familiar annual transition, but one that reminds us how quickly things can change.

This year’s transition also marks an interesting milestone. Two years ago, our inaugural compliance and remediation newsletter examined the emerging landscape of artificial intelligence (AI) regulation. At the time, AI was already transforming how businesses operated, but governments around the world were still working to determine how best to regulate it.

Since then, AI has advanced at a remarkable pace. What was once considered an emerging technology has become an increasingly important part of everyday business operations. Meanwhile, the regulations designed to keep pace with these changes have continued to evolve.

Much like the changing seasons, the regulatory landscape looks considerably different than it did two years ago. Some of the proposals we initially examined have become enforceable laws. Others have stalled, been revised, or been replaced by different approaches.

With that in mind, this is a good opportunity to revisit the state of AI regulation. Let’s look at how the United States, European Union, and China have progressed since our original review and what these changes mean for organizations preparing for the next chapter of AI adoption.

United States: A patchwork of federal and state approaches

When we first examined AI regulation in 2024, the United States had several proposed federal laws, including the Algorithmic Accountability Act and the DEEPFAKES Accountability Act. Neither had gained significant traction in Congress.

Two years later, the U.S. still has no single, comprehensive federal AI law comparable to the European Union’s AI Act. However, the regulatory environment has continued to evolve. Instead, the United States has developed a more decentralized approach involving targeted federal legislation, executive policies, voluntary standards, existing regulatory authority, and a growing collection of state laws.

At the federal level, the TAKE IT DOWN Act became law in May 2025, addressing the distribution of non-consensual intimate imagery, including AI-generated deepfakes. Meanwhile, broader legislation, such as the Algorithmic Accountability Act, has continued to struggle to gain congressional approval.

The federal government’s overall approach has also shifted. In July 2025, the White House released America’s AI Action Plan, outlining more than 90 policy actions intended to accelerate AI innovation, expand supporting infrastructure, and strengthen American competitiveness. A subsequent executive order in December 2025 emphasized the administration’s preference for a more uniform national AI policy with fewer regulatory barriers to innovation.

While Washington has focused on encouraging innovation and addressing specific risks, individual states have advanced their own regulatory initiatives. In 2025, all 50 states considered AI-related legislation, with 38 states adopting or enacting approximately 100 measures. This activity continued into 2026, with states addressing automated decision-making, employment discrimination, healthcare, data privacy, consumer protection, and AI-generated content.

Texas, for example, enacted the Responsible Artificial Intelligence Governance Act, which took effect January 1, 2026. California and Colorado have also developed requirements addressing AI transparency, discriminatory outcomes, and high-risk applications.

European Union: From planning to enforcement

The European Union has taken a considerably different approach. When we last reviewed this subject, the EU had recently introduced its Artificial Intelligence Act, establishing one of the world’s first comprehensive regulatory frameworks for AI. The Act established a risk-based model, with regulatory requirements increasing according to the potential harm associated with an AI application.

Since then, the EU has shifted from developing its regulatory framework to implementing and enforcing it. Initial restrictions on certain prohibited AI practices and requirements related to AI literacy became applicable in February 2025. Additional requirements for general-purpose AI models followed in August 2025, and a substantial portion of the Act became applicable in August 2026.

However, the EU has also demonstrated a willingness to adjust its approach. In 2026, European policymakers approved changes that delayed certain high-risk AI requirements. Requirements for standalone high-risk systems are now scheduled for December 2027, while certain AI systems incorporated into regulated products generally have until August 2028.

These adjustments address a concern raised in our original newsletter: Could aggressive AI regulation unintentionally restrict innovation? By extending certain implementation deadlines, the EU appears to be acknowledging the practical challenges organizations face when adopting complex governance requirements.

The ultimate effectiveness of the AI Act remains to be seen. However, the EU has made significant progress in translating broad principles of responsible AI into defined expectations for governance, documentation, transparency, and risk management.

China: Expanding an established regulatory framework

China has followed another path, building upon regulations that were already in place when we first examined the subject. Its Interim Measures for the Management of Generative AI Services, implemented in August 2023, established requirements covering AI-generated content, data privacy, security reviews, and provider responsibilities. Rather than replacing those requirements, China has continued to expand them.

In September 2025, new regulations governing the labeling of AI-generated and synthetic content became effective. These measures address AI-generated text, images, audio, video, and virtual environments, establishing requirements for visible and machine-readable identification in applicable circumstances. The goal is to improve transparency and make AI-generated material easier for platforms, regulators, and consumers to identify.

China’s approach remains more centralized and prescriptive than the models used in the United States and European Union. While this model can allow requirements to be implemented relatively quickly, it also involves extensive government oversight and content controls.

For international organizations, these differences reinforce an important point: AI governance cannot always be approached as a single, globally uniform compliance exercise.

What have we learned after two years?

Looking back at our original review, it’s interesting to see how differently AI regulation has developed across the globe. The United States has emphasized innovation while allowing states to establish many of their own requirements. The European Union has created a comprehensive regulatory structure but adjusted certain deadlines to accommodate implementation challenges. China has continued expanding its existing centralized framework.

Despite these differences, all three approaches reflect a common reality: AI is becoming too important to business and society for governments to ignore.

The pace of regulatory change continues to lag behind technological innovation. New AI applications, including increasingly autonomous systems and AI agents, are emerging faster than many organizations can develop governance frameworks to manage them. This creates a challenge for compliance professionals: How do we prepare for regulations that may not yet exist while ensuring that today’s AI applications are being used responsibly?

The answer starts with strong internal governance. Organizations should establish clear ownership of AI systems, document how automated decisions are made, monitor applicable regulatory developments, and regularly assess AI-related risks. Controls involving data privacy, transparency, human oversight, and testing should be incorporated into AI initiatives from the beginning rather than added after deployment.

As we’ve discussed in previous newsletters, AI governance shouldn’t be viewed as an obstacle to innovation. It should be one of the foundations that makes sustainable innovation possible.

How Turnberry can help

The changing AI regulatory landscape creates both challenges and opportunities for organizations adopting new technologies. Turnberry Solutions can help clients navigate these changes by assessing existing AI governance practices, identifying regulatory and operational risks, and developing practical compliance roadmaps aligned with their business objectives.

Our consultants can help establish AI policies and controls, improve documentation and oversight, implement risk-based testing strategies, and integrate AI monitoring into existing compliance processes. We can also help organizations identify opportunities to use AI in their own compliance and remediation efforts, including regulatory monitoring, risk identification, control testing, and reporting.

Our goal is to help clients build adaptable governance capabilities that can evolve alongside changing regulations, technologies, and business needs.

Much like preparing for winter before the first snowfall, the most effective time to establish these safeguards is before they’re urgently needed.

---

Other compliance news: F6 implementation moves into a new season

AI regulation isn’t the only area undergoing significant change. In the healthcare and pharmaceutical industries, the transition to the National Council for Prescription Drug Programs (NCPDP) Telecommunication Standard Version F6 continued to advance during Q3 2026.

You may recall that we first examined the F6 Final Rule in our Q3 2025 newsletter. At the time, pharmacy benefit managers (PBMs), pharmacies, health plans, and technology vendors were primarily focused on assessing the new requirements and developing implementation strategies. A year later, the industry’s focus is shifting from planning and design toward system development, integration testing, and operational readiness.

In September 2026, NCPDP published updated editorial guidance clarifying elements of the F6 Implementation Guide and Data Dictionary. These clarifications are intended to help organizations interpret requirements involving transaction mapping, data validation, and system functionality. NCPDP also held an industry webinar in August focusing on the technical and operational challenges associated with transitioning from the existing D.0 standard to F6.

As the implementation deadline approaches, more PBMs are treating F6 as an enterprise-wide operational transformation rather than simply a regulatory technology upgrade.

The implementation timeline remains unchanged

The mandatory compliance deadline remains April 14, 2028, while an eight-month transition period begins August 14, 2027. During this transition period, covered entities may, by mutual agreement with their trading partners, use either the existing or updated transaction standards.

Although these dates may seem comfortably distant, the transition requires significant coordination among organizations whose systems depend on exchanging accurate, timely pharmacy transaction data.

For PBMs and other healthcare organizations, successful implementation requires more than completing individual application changes. End-to-end testing must demonstrate that transactions flow correctly across claims-processing platforms, eligibility-related systems, pharmacies, health plans, vendors, and downstream applications.

Organizations must also prepare for dual-standard processing during the transition period, including production monitoring, issue resolution, and cutover planning.

While the regulatory requirements are well-defined, the operational risks associated with implementation remain substantial.

Helping healthcare organizations prepare for F6

As the industry moves closer to the August 2027 transition period, the focus will increasingly shift from whether individual systems have been updated to whether the entire transaction ecosystem is prepared to operate together.

Turnberry Solutions can help healthcare and pharmaceutical organizations navigate this transition through coordinated program management, business and technology alignment, testing strategies, and operational readiness planning.

Our consultants can help clients identify impacted applications and business processes, manage dependencies across internal teams and external partners, develop integrated implementation schedules, and establish transparent reporting for program leadership. We can also support testing coordination, risk management, change management, and transition planning to help ensure that system upgrades translate into compliant, reliable business operations.

---

Looking ahead: Preparing for the next season

As we move into the final quarter of 2026, the regulatory environment continues to demonstrate that change is constant, whether we’re talking about AI governance, healthcare data standards, or other compliance requirements. Some regulations are expanding, others are being refined, and still others are moving from legislative proposals into active implementation.

For businesses, the challenge isn’t simply keeping up with what’s changing. It’s understanding how those changes affect their people, processes, technologies, and customers. The changing seasons provide a useful reminder that preparation is often the difference between successfully navigating change and being caught off guard.

Compliance and remediation teams should approach the coming months with that same mindset: review existing controls, assess emerging risks, prioritize upcoming deadlines, and strengthen the systems and processes needed for the future.

Autumn is traditionally a time to take stock of what we’ve accomplished, evaluate what needs attention, and prepare for what’s next. After all, the seasons will keep changing. The question is whether our organizations are ready to change with them.