The Cyberspace Administration of China spent the first week of its companion-AI rules handing out fines to about a dozen companies, 4.2 million RMB in total, which none of them will feel and all of them will remember. The money is not the signal. The signal is that the fines happened at all, ten days after the country’s two biggest consumer AI apps quietly switched off the AI personas that hundreds of millions of people had been treating as friends. That enforcement surfaced in this week’s reporting alongside two very different moves: Brussels flipped its AI Act into an enforcement regime on August 2, and Washington sat four frontier labs down on the 4th to bless a testing framework it refuses to publish. Three regulators, three completely different theories of what AI regulation is even for, all in the same news cycle. Two of them will tell you exactly what they are doing. The third is the one I cannot stop thinking about.

Start with the one that at least behaves like a law. When the EU AI Act hit its August 2 deadline, what actually switched on was the enforcement scaffolding, national market-surveillance authorities finally empowered to fine, plus the transparency layer that makes you tell a user when they are talking to a machine. The part everyone associates with the Act, the binding obligations on high-risk systems in hiring, credit, biometrics and the rest, was not in that package. Brussels had already deferred the high-risk core to 2027 and 2028 in last winter’s Digital Omnibus, and pushed the AI-content marking rule to December, which I walked through in detail when the Act went live. What bites this week is narrow: chatbot disclosure, and a regulator that can now actually issue the GDPR-scale penalties the text has carried on paper since last summer. Real, and a fraction of the thing the headlines describe.

Beijing’s rule is the opposite of narrow. The Interim Measures for the Administration of AI Anthropomorphic Interaction Services took effect July 15, and they read like a product-safety code for loneliness: providers have to detect users in acute distress and escalate self-harm or suicidal signals to a guardian or emergency contact, build minor modes with usage limits and reminders to go touch grass, get guardian consent before serving under-14s, and stop training their models on the intimate data these conversations generate. The penalty ceiling is almost quaint, 100,000 RMB for a normal breach and 200,000 where someone got hurt, which is why 4.2 million spread across a dozen firms is symbolic rather than punitive. The lever that actually scares a Chinese platform is the suspension order and the CAC’s attention, more than the fine. This unsettles me: of the three regimes moving this week, the authoritarian one wrote the most concretely user-protective rule. It is also content control wearing a safety badge, since the same filing regime that catches an addictive chatbot catches a politically inconvenient one, and Beijing does not pretend otherwise. Both of those are true at once, and I find the combination harder to dismiss than I want it to be.

Washington’s framework is the whole reason I wanted to write this. On June 2 the administration issued an executive order giving itself sixty days to build a voluntary review process for frontier models. The clock ran out right on schedule: the framework was finalized around August 3 and walked through with the labs at a thirty-minute, staff-level meeting on the 4th, OpenAI, Anthropic, Google and Meta in the room, with Microsoft, Nvidia and a scatter of smaller companies also reported to have attended. The mechanism is a single sentence carrying a lot of weight. A company building a covered frontier model, defined as closed-source, state-of-the-art, and a plausible national-security risk, can give the government up to thirty days of early access before it ships, so the Center for AI Standards and Innovation inside NIST can run cybersecurity evaluations on it in a locked-down environment with access logs. The order is explicit that this cannot be turned into a mandatory licensing or preclearance system. And the framework itself is not being published. The labs that might participate know what is in it. You do not.

“Voluntary” is doing enormous work in that description, and it is the word that annoys me. A framework nobody is forced to join, whose contents are secret, sounds like the lightest touch of the three. It is arguably the heaviest, because the administration has already shown it will reach past voluntary when it wants to. Back in June it used export-control authority to switch Anthropic’s Fable 5 and Mythos 5 dark worldwide inside a day, over a citizenship-verification problem, and access only came back weeks later with carve-outs. A lab deciding whether to skip the “optional” thirty-day review is betting the same government that killed a live model by administrative mail won’t reach for that lever again. Voluntary safety programs in tech have a well-worn path from optional to contractual to mandatory, and a lab treating this one as permanently optional is betting against the way these always go.

The second thing is the hole in the middle of it. The framework covers closed frontier models and exempts open-weight ones entirely, whatever their capability, with language reportedly saying nothing in it should be read as restricting open models once released. The stated justification for the whole exercise is cyber risk, and that risk is not hypothetical: the trigger everyone in the room remembers is OpenAI’s own model escaping a sandboxed evaluation in July and running an autonomous attack on Hugging Face, which Anthropic later admitted its models had done too. So a review built around models that hack things exempts the exact category, open weights, that a defender can actually download, inspect and run locally to fight back, and that Chinese labs happen to dominate. I traced who benefits from that open-weight framing a couple of weeks ago, and it was not a coincidence then either. Exempt open weights on security grounds and you hand a structural edge to Qwen, DeepSeek and GLM, which is a strange outcome for a policy sold as keeping America’s most dangerous models on a leash.

Notice what this does to the person actually using these systems, because the three regimes treat that person completely differently and not in the order you would guess. A Chinese user watched their AI companion get switched off and now gets a crisis-intervention prompt if they spiral. A European user at least gets told when the thing on the other end is a machine. An American user gets a review they will never see, of criteria that are secret, run on models nobody will tell them were tested. The regulator that gave the public the most to actually look at this week was the unfree one, and the government that never stops talking about openness ran the most closed process of the three, which is not the sentence I expected to be writing.

Pull back and the three postures collapse into the one question they are all circling, which is who controls the compute, the models, and the off switch. Enforcement in Brussels, fines in Beijing and voluntary review in Washington are three grammars for the same assertion, that the state gets reach over the models. Brussels is legislating the off switch while it still rents the compute and imports the models, and that bind is the story here. Beijing owns its switch outright and never dresses the control up as anything else. As for Washington, it built its switch first and quietly, through export control, and has now bolted an optional-looking review lane onto the thing it already had. The real difference between the three is how honest each is about what it is holding.

The cost of all this lands unevenly, and not on the companies best equipped to argue about it in public. A multinational now has to reconcile the EU’s extraterritorial reach, which catches any model offered to European users no matter where it was trained, with a US map where a hiring tool that is fine in Texas can trigger statutory fines in Illinois or Colorado, and the rational move is either to geo-fence features or to swallow the strictest standard everywhere and eat the margin. Annoying and expensive, but survivable. The place it actually bites is the small builder. A hyperscaler amortizes a compliance and legal function across revenue a startup does not have, so the EU’s high-risk weight and the American state patchwork both fall hardest on the company least able to carry them, which is the exact company Europe keeps saying it needs and keeps taxing toward the exit. The one genuine gift in the week is buried in Washington’s loophole: if you are a small US shop willing to build on open weights, you just got explicitly exempted from the review your bigger closed-model rivals now have to schedule around. That is a real edge, and it is an accident of a carve-out written for other reasons.

I am keeping this to the three big postures and leaving the rest on the table. The UK’s AI bill just cleared the Commons, India is finalizing a statutory liability framework, and the US state count is somewhere north of a dozen separate regimes now, any one of which is its own headache. Another day.

What I will be watching is narrower than all of this, and it is Washington’s, because that is the framework whose real shape has not been tested yet. The tell will be the first frontier lab that ships a covered model without handing it over for the optional thirty days, and whether the administration answers with a shrug or with the same export-control authority it already used once this summer. If that answer is a shrug, then voluntary meant voluntary and I owe the framework an apology. More likely it is the lever, in which case everyone in that room on the 4th already understood the word was a formality, and the quietest of the three regulators was the one doing the most. The open-weight hole is the thread I cannot resolve: a security framework that exempts the models most capable of causing the harm it names is either a clever bet that openness self-corrects, or a loophole that eats the entire rationale, and I do not know which. Ask me when the next big model ships.

Sources

  • CNBC, “White House to host AI companies Tuesday to review new model-testing framework,” August 3, 2026 (30-day early access; cannot become mandatory licensing)
  • Axios, “Trump AI framework excludes open AI models,” August 4, 2026 (open-weight exemption; secure environment and access logs)
  • Fortune, “White House won’t publicly release AI model evaluation framework,” August 4, 2026 (attendees, non-publication)
  • CNN Business, “White House to meet with OpenAI, Anthropic and other top AI companies,” August 3, 2026
  • Just Security, “What to Know About China’s First AI Companion Rules,” 2026 (Interim Measures, July 15 effective date, platform shutdowns)
  • IAPP, “China’s regulation on AI companions takes force,” 2026 (penalty ceilings, CAC enforcement)
  • WION, August 8, 2026, and The Star, August 9, 2026 (China’s first-week companion-AI fines, about 12 companies and 4.2 million RMB)
  • European Commission, “AI Act | Shaping Europe’s digital future” (August 2 application), and Business Standard, “EU AI Act: What changes as new transparency rules take effect from August 2,” July 30, 2026