Two AI compliance obligations became enforceable this week that affect a far broader range of companies than most founders realize. The Take It Down Act — the federal law requiring platforms to remove non-consensual intimate imagery and AI-generated deepfakes within 48 hours of a valid request — becomes enforceable today, May 19, 2026, with FTC civil penalty authority of $53,088 per violation. Simultaneously, the New York State Comptroller's December 2025 audit of New York City's AI hiring bias audit law concluded that enforcement has been "ineffective" — and the City's enforcement agency committed to implementing stricter oversight, signaling the start of a materially more aggressive enforcement phase for employers using AI in hiring decisions. Both obligations are active. Both apply to companies far beyond the obvious targets. Both require action now.

The Big Picture

The week of May 18, 2026 marks a shift from AI compliance as aspiration to AI compliance as enforcement. The Take It Down Act is not a new law this week — it was signed on May 19, 2025 — but its platform compliance obligations took effect today, which means FTC enforcement authority activates for the first time. New York's AI hiring law has been on the books since 2023, but its enforcement has been so weak that a State Comptroller audit found 17 potential compliance issues in a set of audits that the City's enforcement agency said had only one. Both situations are changing simultaneously, in the same week. For founders operating platforms or using AI in employment decisions, this is the compliance inflection point — not a future milestone, but today.

1. AI and Emerging Tech — The Take It Down Act: FTC Enforcement Is Now Live

The Take It Down Act became law on May 19, 2025. Its platform compliance requirements — requiring covered platforms to establish notice-and-takedown mechanisms for non-consensual intimate imagery (NCII) and AI-generated deepfakes — take effect today, May 19, 2026. The Federal Trade Commission has enforcement authority, and violations are treated as unfair or deceptive trade practices under the FTC Act, carrying civil penalties of $53,088 per violation with no administrative exhaustion requirement.

What covered platforms must have operational as of today:

1. A published, user-accessible takedown request mechanism — the submission process for NCII and AI-generated deepfake removal requests must be clearly findable, not buried; the FTC's guidance specifically identifies accessibility as a core compliance element
2. 48-hour removal obligation from receipt of a valid request — the clock starts from receipt, not from internal triage or review; "known identical copies" across the platform must also be addressed within the same window
3. Request tracking with unique identifiers — each valid takedown request must receive a tracking number and the requester must be kept informed of removal status
4. Good-faith compliance documentation — the Act's liability safe harbor for good-faith removal decisions requires contemporaneous documentation of the decision-making process; platforms that cannot demonstrate good-faith compliance cannot rely on the safe harbor
5. Counter-notice and dispute procedures — platforms need a process for notifying uploaders of removed content and handling disputes about whether specific content was properly removed

The FTC's pre-enforcement warning letters — sent last week to Amazon, Alphabet, Apple, Meta, Microsoft, TikTok, X, Discord, Reddit, Snapchat, and others — made clear that the agency intends to enforce from day one. But the 15 named companies are the most visible targets, not the only ones. The covered platform definition is broad: any website, online service, application, or mobile app that serves the public and primarily provides a forum for user-generated content. Community forums, image-sharing tools, gaming platforms with user content, adult content platforms, and any application where users upload media are in scope. If your product allows users to post or share images or video and serves the public, the covered platform analysis applies regardless of whether your company appeared on the FTC's warning letter list.

Why the Take It Down Act Matters Beyond Social Media

The most common misconception about the Take It Down Act is that it applies only to large social networks. It does not. The FTC's enforcement authority applies to any covered platform regardless of size. A startup with 50,000 users that hosts user-generated images is a covered platform. An adult content marketplace with a niche audience is a covered platform. A gaming community with user-uploaded content is a covered platform. The $53,088 per violation penalty structure is not scaled to company size — it is a flat civil penalty that applies equally to a startup and to Meta. The practical implication: smaller platforms that have not implemented compliant takedown mechanisms are carrying disproportionate enforcement risk relative to their resources. Implementing a compliant process now is materially cheaper than resolving an FTC civil penalty action later.

2. Corporate and Securities Law — New York's AI Hiring Law: Enforcement Is About to Get Much Stricter

New York City Local Law 144 — which requires employers using automated employment decision tools (AEDTs) in hiring to conduct annual bias audits, post results publicly, and notify candidates — has been law since 2023. But a December 2025 audit by the New York State Comptroller concluded that the City's Department of Consumer and Worker Protection (DCWP) enforcement of the law has been "ineffective," creating a false compliance baseline that exposed employers to risk they did not know they were carrying.

What the Comptroller's audit found — and what it means for employers:

1. The enforcement gap is dramatic — the DCWP reviewed 32 publicly posted bias audits and found only one instance of non-compliance; the Comptroller's own review of the same 32 audits identified at least 17 potential compliance issues — more than half of the audited population had problems the City's enforcement agency missed
2. DCWP committed to implementing stricter oversight — in response to the Comptroller's findings, DCWP committed to implementing most of the Comptroller's recommendations, signaling a shift from the historically complaint-driven, low-intensity enforcement model to proactive and systematic oversight
3. The penalty structure is not trivial — violations carry penalties starting at $500 per violation escalating to $1,500 per day for ongoing violations; employers using non-compliant AEDTs for high-volume hiring face cumulative daily penalties that compound quickly
4. New York State lawmakers are moving to expand the law — state legislators are actively working to close loopholes in NYC Local Law 144 and add enforcement teeth at the state level, which would extend similar requirements beyond New York City to employers operating anywhere in New York State
5. The bias audit requirement applies to vendors as well as employers — employers who use third-party AI hiring tools are responsible for ensuring those tools have completed compliant bias audits; vendors that cannot provide documented audit results are creating compliance exposure for their employer-customers

The practical significance of the Comptroller's findings is not just that enforcement will get stricter — it is that many employers who believed they were compliant because the DCWP had not cited them are not actually compliant. The enforcement gap the Comptroller identified means that a substantial portion of NYC employers using AEDTs have been operating under a false compliance assumption. The shift to stricter enforcement will expose that gap.

3. How Launch Legal Helps Founders and Employers Navigate These Developments

For platform operators of any size with user-generated content: Take It Down Act enforcement is live today. If your platform does not have a compliant NCII and deepfake takedown mechanism, the exposure begins with the first valid request you receive and fail to process within 48 hours. We help platforms conduct a rapid covered-platform analysis, implement the minimum viable compliant takedown workflow, and build the good-faith documentation infrastructure that supports the Act's liability safe harbor.

For AI-powered HR tech vendors selling to employers: the stricter NYC enforcement regime creates a new sales-cycle liability for HR tech vendors. Employers will increasingly require their AEDT vendors to provide documented bias audit results before contracting — and will hold vendors contractually responsible for compliance gaps. We help HR tech companies build vendor-side compliance frameworks that satisfy employer due diligence requirements and protect against contractual liability when the employer-customer faces an enforcement action.

For employers using AI tools in hiring, performance evaluation, or compensation decisions: the Comptroller's findings mean that prior DCWP non-citation is not evidence of compliance — it is evidence that the enforcement agency was not effectively reviewing audits. We help employers conduct a genuine Local Law 144 compliance audit — reviewing their AEDT inventory, confirming that bias audits meet the substantive requirements the Comptroller identified as commonly deficient, and updating public disclosure and candidate notification processes to meet the stricter standard the DCWP is now committed to enforcing.

For New York State employers preparing for expanded AI hiring law coverage: the state-level expansion effort signals that Local Law 144's requirements will extend beyond New York City to cover employers operating anywhere in New York State. We help employers build AI hiring compliance programs designed for state-level coverage from the start, rather than New York City-specific programs that will require restructuring when state legislation passes.

4. The Musk v. Altman Verdict: Still Pending — What the Delay Means

The Musk v. Altman jury began deliberations on Monday, May 18, following closing arguments on May 14. No advisory verdict has been announced as of today. The jury's advisory finding — when it arrives — will be evaluated by Judge Yvonne Gonzalez Rogers, who will make the final determination on liability. If the court finds liability, the remedies phase will address whether to unwind OpenAI's for-profit conversion and what damages, if any, apply.

For founders, the deliberation period itself is informative: the jury is working through questions about whether Musk's 2024 lawsuit was timely filed — a threshold issue — before reaching the merits of the charitable trust breach claim. Whatever the verdict, the trial record has established the governance failure patterns that define existential legal risk for AI startups: undocumented founding commitments, informal board decisions on transformative structural changes, and the legal exposure created when a nonprofit mission is cited in fundraising but not honored in governance documentation. Those patterns are now public legal record regardless of the outcome.

What Founders and Employers Should Think About Now

• Platform operators with user-generated content: Take It Down Act enforcement is active as of today — if your takedown mechanism is not live and tested, the exposure begins with your first unprocessed valid request; implement now, not after your first FTC inquiry

• Smaller platforms and startups with UGC features: the $53,088 per violation penalty is not scaled to company size; the enforcement risk for a 50,000-user startup that hosts user images is the same as for a major social network — and the resources to absorb an FTC action are far smaller

• NYC employers using AI in hiring: prior DCWP non-citation is not a compliance safe harbor; the Comptroller found the enforcement agency was missing more than half of non-compliant audits; conduct a genuine internal compliance audit against the substantive bias audit requirements, not just the checkbox requirements the DCWP historically reviewed

• HR tech vendors: your employer-customers will increasingly require documented bias audit results before contracting — build vendor-side compliance documentation into your sales process and product offering before the first customer due diligence request arrives

• New York State employers: plan your AI hiring compliance for state-level coverage from the start; the legislative effort to expand Local Law 144 statewide is active and the direction is clear

• All startup founders: monitor the Musk v. Altman advisory verdict this week — the legal framework the court applies to OpenAI's nonprofit-to-for-profit conversion will define how similar transitions are evaluated at every AI organization for the next decade

Strategic Takeaway

Opportunity → The NYC AI hiring law enforcement overhaul creates a genuine competitive advantage for employers who achieve genuine compliance — not just checkbox compliance — before the stricter enforcement phase begins. Employers who conduct thorough bias audits, post complete and accurate results, and implement meaningful candidate notification procedures are positioned to demonstrate compliance to any level of DCWP scrutiny. Employers who relied on the historically weak enforcement environment to avoid genuine compliance are now exposed to a stricter regime they did not prepare for.

Risk → The Take It Down Act's flat per-violation penalty structure is the most acute near-term enforcement risk for platforms with user-generated content. A platform that receives 50 valid NCII takedown requests in its first week of enforcement and fails to process them within 48 hours is facing potential penalties of over $2.6 million — from one week of non-compliance. There is no penalty cap, no cure period, and no warning before the FTC can bring a civil action. The risk is not theoretical. It begins today.

What Comes Next

Watch for the first FTC enforcement actions under the Take It Down Act — the agency's initial cases will define the practical scope of enforcement, what size platforms the FTC prioritizes, and what "reasonable" compliance looks like for platforms at different stages of development. Watch for the Musk v. Altman advisory verdict — expected this week — and the remedies phase that follows if the court finds liability. Watch for the New York State AI hiring bill's committee advancement — state-level expansion of Local Law 144 is an active legislative effort and its passage would materially expand the employer compliance obligation beyond New York City. And watch for the CLARITY Act Senate floor vote — now that the bill has cleared committee, the floor vote timeline is the next planning horizon for digital asset founders.

Bottom Line

May 18, 2026 is the day two AI compliance obligations transition from pending to enforceable. The Take It Down Act is live. FTC enforcement authority is active. The NYC AI hiring law is entering a materially stricter enforcement phase. Both obligations apply to companies that may not have realized they were covered — smaller platforms, niche UGC services, and employers who have been relying on the historically weak DCWP enforcement environment. The founders and employers who act today will close the compliance gap before enforcement finds them. The ones who wait will close it under investigation.

Learn More

At Launch Legal, we advise platform operators, HR tech companies, and employers on exactly the AI compliance obligations that became enforceable this week — from Take It Down Act implementation to NYC Local Law 144 bias audit compliance to New York State AI hiring law preparation. If today's enforcement deadlines raised questions about your platform or employment practices, reach out for a consultation.

Sources & Further Reading:

• FTC — Chairman Ferguson Advises Companies to Comply With the Take It Down Act

• CyberScoop — Here's How the FTC Plans to Enforce the Take It Down Act

• DLA Piper — Critical Audit of NYC's AI Hiring Law Signals Increased Risk for Employers

• Fisher Phillips — New York Lawmakers Aim to Close Loopholes in NYC's AI Bias Audit Law

• Wiley — May 19 Deadline for Take It Down Act Compliance: Is Your Company Prepared?