ai regulation: what the enforced record already shows in 2026

Everyone is waiting for the AI bill. Meanwhile regulators fined Clearview 30.5 million euros, banned an AI storefront scheme, and let a nationwide age case against Workday proceed, all under laws that already exist.

Every operator buying or building an AI system asks the same question this year: what happens when the regulation lands? The debate is loud, the bills are drafting, and the honest answer is that most of the waiting is misplaced.

Because the regulation is not a future event. It is already here, and it arrived without a new statute. On 3 September 2024 the Dutch Data Protection Authority published a 30.5 million euro fine against Clearview AI for building an illegal facial-recognition database (source).

That fine used the GDPR, a 2018 data-protection law that never mentions artificial intelligence. It is the pattern across the whole enforced record: regulators are not waiting for an AI law, they are applying the laws they already have.

What ai regulation means in practice

Ai regulation is the use of legal authority to constrain how AI systems are built, sold, and deployed. In practice today it means enforcement under existing data-protection, consumer-protection, employment, and fair-housing law, not a single dedicated AI statute.

That distinction matters because the public conversation treats regulation as something that has not happened yet. The enforced record says otherwise, and it is the part a buyer can actually check.

How is AI regulated right now?

AI is regulated right now the same way any other business conduct is: a regulator or a court takes an existing law and applies it to what the system did. No AI-specific rule is required for a fine or a ban to follow.

The Dutch case makes the point sharply. The regulator found that Clearview’s database holds more than 30 billion photos scraped from the internet and converted into a biometric code per face, without consent, and fined it 20 million euros for the database plus 10.5 million euros for refusing access requests (source). Clearview did not object to the decision, which means it cannot appeal the fine. TIN’s case file on the Clearview fine traces every figure to the regulator’s own decision.

What happens when an AI product is oversold?

Overselling an AI product is treated as deceptive marketing, and the consumer-protection regulator already has the tools to stop it. The FTC does not need an AI law to act on a false AI claim.

In FTC v. Ascend Capventures, a federal court entered a 25 million dollar judgment and a permanent ban against operators who marketed “AI-powered” passive-income storefronts (source). The FTC alleged that “virtually none of Ascend’s clients earn the advertised income,” and the order expressly bars the defendants from claiming a product “will use artificial intelligence (AI) to maximize revenues” (source). The action was one of five in the FTC’s Operation AI Comply sweep. The full order and its terms are on record.

Can you sue over an AI hiring or screening tool?

Yes, and two of the clearest cases target the vendor of the tool, not just the employer that used it. Employment and fair-housing law reached the algorithm directly.

On 16 May 2025 a US federal court let a nationwide age-discrimination case against Workday’s AI applicant-screening tool proceed as a collective action, opening it to job applicants aged 40 and older denied recommendations since September 2020 (source). It is a procedural certification, not a merits finding, and Workday denies wrongdoing. The Mobley v. Workday case file keeps that distinction intact.

Tenant screening ran the same way. In Louis v. SafeRent, a Massachusetts court approved a 2.275 million dollar class settlement and, for five years, barred SafeRent from putting a score or an accept-or-decline recommendation on screening reports for housing-voucher applicants (source). The settlement carries an express non-admission clause: no court found discrimination. TIN’s SafeRent case file shows the cap and the carve-outs as the court wrote them.

Does AI regulation reach governments too?

It does, and one of the earliest and most consequential AI enforcement actions was against a state. Data-protection law binds a public body the same as a company.

On 7 December 2021 the Dutch DPA fined the Tax Administration 2.75 million euros for using nationality as an indicator in a self-learning risk-classification algorithm and unlawfully retaining dual-nationality data of childcare-benefit applicants (source). That algorithm was the engine of the toeslagenaffaire scandal, which brought down a government. The case file documents the finding.

The enforced record side by side

Case	Enforcer	Law applied, not an AI statute	Outcome
Clearview AI	Dutch DPA	GDPR (data protection)	30.5M euro fine, unappealable
Ascend Ecom	US FTC	FTC Act (consumer protection)	25M dollar judgment, permanent ban
Mobley v. Workday	N.D. Cal. court	ADEA (age discrimination)	Nationwide collective certified
Louis v. SafeRent	D. Mass. court	Fair Credit Reporting and fair-housing law	2.275M dollar settlement, 5-year score ban
Dutch Tax Administration	Dutch DPA	GDPR (data protection)	2.75M euro fine against a government

What TIN’s case files document

Each row is a TIN case file built on the primary record, the regulator’s decision or the signed court order, not a press summary. Where the public sources disagree, the case file shows the conflict instead of averaging it away, and where a ruling is procedural rather than a finding of wrongdoing, it says so.

That is the difference between reading a headline about AI regulation and reading the order behind it. A headline tells you a fine happened. A case file lets you follow the number to the document that imposed it.

The bottom line

The tempting read is that AI is unregulated until a dedicated law passes. The enforced record refuses it. Five separate actions, across two continents and four bodies of law, have already produced fines, bans, certified class actions, and settlements against AI and algorithmic systems, none of them relying on an AI-specific statute.

For an operator, the transferable lesson is not to watch the legislature. It is that the exposure already exists under the law you are subject to today. The question a buyer should ask a vendor is not “are you compliant with the coming AI act,” it is “would your system survive the GDPR, the FTC Act, and an employment claim right now,” because those are the rules doing the enforcing.

Sources

1. Autoriteit Persoonsgegevens, “Dutch DPA imposes a fine on Clearview because of illegal data collection for facial recognition,” 2024-09-03. https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-on-clearview-because-of-illegal-data-collection-for-facial-recognition
2. U.S. Federal Trade Commission, “FTC Case Leads to Order Banning Ascend Ecom, Its Owners from Business Opportunity Marketing,” June 2025. https://www.ftc.gov/news-events/news/press-releases/2025/06/ftc-case-leads-order-banning-ascend-ecom-its-owners-business-opportunity-marketing
3. Holland & Knight, “Federal Court Allows Collective Action Lawsuit Over Alleged AI Hiring Discrimination,” May 2025. https://www.hklaw.com/en/insights/publications/2025/05/federal-court-allows-collective-action-lawsuit-over-alleged
4. Cohen Milstein Sellers & Toll, “Louis, et al. v. SafeRent Solutions, et al.,” November 2024. https://www.cohenmilstein.com/case-study/louis-et-al-v-saferent-solutions-et-al/
5. Autoriteit Persoonsgegevens, “Tax Administration fined for discriminatory and unlawful data processing,” 2021-12-07. https://www.autoriteitpersoonsgegevens.nl/en/current/tax-administration-fined-for-discriminatory-and-unlawful-data-processing
6. TIN case files: Clearview AI, FTC v. Ascend Ecom, Mobley v. Workday, Louis v. SafeRent, Dutch Tax Administration (full source lists on each page).

Questions

How is AI regulated right now?

AI is regulated right now through laws that already exist, enforced case by case. Data-protection regulators used the GDPR to fine Clearview AI 30.5 million euros, the FTC used consumer-protection law to ban an AI-storefront scheme, and courts applied age-discrimination and fair-housing law to AI hiring and tenant-screening tools, all without any AI-specific statute.

Is there a law that regulates AI?

There is no single law that regulates AI in the United States, but there does not need to be one for enforcement to happen. Regulators are applying general-purpose data-protection, consumer-protection, employment, and fair-housing law to AI systems, and the fines and court orders are already on the record.

What happens to a company that breaks AI rules?

It faces the same tools regulators already use: fines, court judgments, permanent bans, and settlements. Clearview drew a 30.5 million euro fine it cannot appeal, Ascend Ecom drew a 25 million dollar judgment and a permanent ban, and SafeRent agreed to stop scoring voucher applicants for five years.

Sources

1. Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Dutch DPA imposes a fine on Clearview because of illegal data collection for facial recognition , 2024-09-03
2. U.S. Federal Trade Commission, FTC Case Leads to Order Banning Ascend Ecom, Its Owners from Business Opportunity Marketing , 2025-06
3. Holland & Knight, Federal Court Allows Collective Action Lawsuit Over Alleged AI Hiring Discrimination , 2025-05
4. Cohen Milstein Sellers & Toll, Louis, et al. v. SafeRent Solutions, et al. , 2024-11
5. Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Tax Administration fined for discriminatory and unlawful data processing , 2021-12-07

---

This is analysis, not a verified outcome. It carries no verification badge and never will. The proof lives in the case files, where every figure is checked against the public record and the method is printed on the page.