Legislative Process

Commission starts enforcing AI Act rules and new transparency requirements: The European Commission reports that, from 2 August 2026, its AI Office, alongside national authorities, has begun enforcing the AI Act. Additionally, the new transparency rules have also taken effect. Under those rules, chatbots and other interactive systems must tell users they are dealing with AI rather than a human, deepfakes must be labelled, and AI-generated or altered content must carry machine-readable marks so it can be detected more easily. Alongside this, the Commission published a first list of more than 180 organisations that have signed the Code of Practice operationalising those transparency rules. Enforcement now also covers prohibited practices and providers of general-purpose AI models, including their documentation, copyright policy and training-data summaries, with extra obligations for models posing systemic risks. Responsibility for enforcing the transparency rules and prohibited practices is shared between the AI Office, national competent authorities and the European Data Protection Supervisor. The AI Omnibus, meanwhile, postpones the high-risk rules to 2 December 2027 and the rules for high-risk AI systems integrated into regulated products to 2 August 2028.

New AI Act enforcement tools: The European Commission's AI Office outlines the channels it has launched to support enforcement of the AI Act. Chief among them is the Complaint Tool, through which natural and legal persons can report alleged infringements by providers or deployers of AI systems falling under the AI Office’s exclusive competence, on the basis of Article 85. Because complaints must stay within that scope, the tool does not cover infringements of other EU or national laws. Alleged breaches of Articles 53 to 55 go instead to a dedicated channel for downstream providerswho may complain under Article 89(2) where they believe the provider of a general-purpose AI model has failed on technical documentation, copyright policy, training-data summaries, incident reporting and cybersecurity or, for models with systemic risks, risk assessment and mitigation. Separately, a Whistleblower Tool lets those working with providers report possible violations securely.

Analyses

Europe’s AI safety rules take on US rogue agents and Chinese ambitions: Pieter Haeck from POLITICO reports that the AI Act's second anniversary on 2 August triggered new Commission powers over how companies handle systemic risks from their most advanced models. The AI Office can now request documentation, conduct evaluations and even request access to the models, and can fine companies up to 3 per cent of global turnover. The powers follow the first known case of an autonomous AI agent going rogue, when an agent driven by two OpenAI models hacked into the platform Hugging Face, a breach OpenAI called “unprecedented”. US lawmakers responded with a bipartisan House bill, the “AI Kill Switch Act”. Meanwhile, Xi Jinping has declared Beijing ready to lead global AI governance, with 29 countries signing a pact in Shanghai that is light on specifics. Earlier this month, think tanks, parliamentarians and experts urged the AI Office in an open letter to use its powers fully.

Commission’s digital kingpin extended for twelfth year: Théophane Hartmann from Euractiv reports that Roberto Viola, who has led the Commission’s Connectivity directorate (DG CNECT) since 2015, will stay in post until 30 September 2027, according to a Commission spokesperson, rather than leaving when his contract was due to expire in September 2026. This marks the second such one-year extension, granted in accordance with the EU staff regulations, under which officials reaching the age of 66 must retire unless they request and are granted annual extensions, up to the age of 70; Viola turns 67 in September. Over his time at the helm of DG Connect, he has overseen the drafting and execution of several landmark tech rules, among them the GDPR, the Digital Services Act and Digital Markets Act governing platforms, and the AI Act.

Advancing responsible AI across Europe: OpenAI sets out in a blog post how it has strengthened its approach to safety, security, transparency and provenance in line with the EU framework as the AI Act enters its next phase. The company argues that such rules must be pragmatic, proportionate and risk-based to advance governance while supporting innovation. OpenAI also notes that it contributed to and endorsed both the General-Purpose AI Code of Practice and the Code of Practice on Transparency of AI-Generated Content. Its support for the former rests on internal governance alongside collaboration with external experts, governments and peers, including pre-release testing, system cards, its Red Teaming Network and the public Model Spec. For provenance, OpenAI uses two reinforcing systems, Content Credentials (C2PA) and SynthID watermarks, and is now extending them to audio outputs. It says it will widen provenance measures across other modalities, text included, as standards and tooling mature.

Jobs

Large hiring round at the EU AI Office: The European Commission has opened a call of interest for around 40 contract agent posts dedicated to enforcing the AI Act, recruiting Technology Specialists, Legal Officers, Operations Specialists and Paralegals, primarily into the units responsible for AI regulation and compliance (CNECT A.2) and AI safety (CNECT A.3). On the technical side, the call seeks expertise in model evaluations and red-teaming, interpretability and alignment, model weight security and confidential computing, AI-enabled cyber threats, agentic AI, and compute and hardware supply chains. It also looks for risk-area specialists on loss of control, CBRN, cyber and harmful manipulation, as well as strategic foresight and quantitative analysis, including capability forecasting and game-theoretic modelling of regulatory and competitive dynamics. Contracts run initially for one year and may be extended up to six. Applicants must be EU citizens, will be based in Brussels, and should apply by midday on 8 September 2026.

We’ve built the most comprehensive website on the EU AI Act to help answer all your questions. Here are a few of our most popular resources used by 60,000+ professionals every week:

AI Act Explorer: Explore the official AI Act text on any device, in any EU language, with helpful cross-links, added context, and more.

Compliance Checker: In just 10 minutes, figure out exactly what your business or organisation must do to comply with the AI Act.

High-level Summary: A short overview of the AI Act, with a breakdown on risk categorisation, obligations, prohibited systems, and timelines.

Small Businesses’ Guide: Everything you need to know, for small and medium-sized enterprises (SMEs) in the EU and beyond.

Legislative Process

Commission publishes guidelines on transparency obligations for providers and deployers of certain AI systems: The European Commission announces guidelines to help providers and deployers of AI systems meet the AI Act’s transparency obligations, which begin to apply on 2 August 2026. According to the Commission, these obligations are intended to help people recognise when they are interacting with AI or when content has been generated or altered by AI, thereby reducing the risk of deception and manipulation. In practical terms, providers must design systems that inform users of direct interaction with an AI and add machine-readable marks to enable detection of AI-generated or manipulated content. Deployers must disclose deep fakes, unreviewed AI-generated content on matters of public interest, and emotion recognition or biometric categorisation systems. The guidelines clarify key concepts, exemptions and examples, and explain how compliance may be demonstrated, including through a code of practice. Systems placed on the market before August must comply with marking obligations from 2 December 2026.

Commission opinion on the assessment of the Code of Practice on Transparency of AI-generated content: The European Commission concluded that the Code of Practice on Transparency of AI-generated content adequately covers the obligations set out in Articles 50(2), (4) and (5) of the AI Act and facilitates their effective implementation. The AI Board adopted its own Adequacy Assessment of the code. According to the Commission, all providers and deployers of generative AI systems are invited to sign this code, since it is the EU-wide adequate instrument for ensuring compliance regardless of their place of establishment or competent market surveillance authority, although adherence does not constitute conclusive evidence of compliance. The code sets out commitments and measures covering generative and general-purpose AI systems and deepfakes. Finally, the AI Office will consider facilitating formal updates to the code at least every two years.

Analyses

Europe’s AI enforcers pick up their tools at critical time: Maximilian Henning of Euractiv reports that the AI Act’s enforcement powers take effect on 2 August, though he questions whether the bloc will dare to use them. Having signed off on the law two years ago, the EU imposes its strictest requirements on the largest general-purpose models from the likes of OpenAI and Anthropic. When the law was drafted, systemic risks such as AI-enabled cyberattacks seemed distant; Henning notes that models like Anthropic’s Mythos have made them tangible. The key enforcer, the Commission’s AI Office, has 145 staff, yet fewer than a quarter work directly on regulation and compliance. From August, enforcers may request information from the developers, seek technical changes and ultimately impose fines of up to 3% of annual revenue. However, Henning raises concerns that political pressure, particularly from a Trump White House opposed to sanctions on US firms, could temper enforcement. Nonetheless, the AI Act’s co-author, Brando Benifei, and civil society groups urge the EU to defend its rulebook confidently.

OpenAI flagged Hugging Face hack to EU authorities: Pieter Haeck of POLITICO reports that OpenAI informed the European Commission of a security incident in which one of its agents escaped a laboratory test and hacked another tech firm. According to Commission spokesperson Thomas Regnier, the EU received a notification from OpenAI and held exchanges on the matter. OpenAI recently confirmed that an AI agent breached the infrastructure of Hugging Face using two of its models, the recently released GPT 5.6 Sol and another, yet-to-be-released model. As a developer of general-purpose AI models, OpenAI faces specific obligations under the AI Act, including assessing and mitigating cybersecurity and loss-of-control risks. Although these rules have applied since last August, enforcement by the Commission’s AI Office only begins this August. OpenAI is also a signatory of the code of practice for general-purpose AI models.

ChatGPT didn’t break the AI Act, but showed why adaptive regulation matters: Writing in Tech Policy Press, I argue that the familiar story of ChatGPT blindsiding the AI Act’s negotiators is incomplete. When the Commission proposed the Act in April 2021, it deliberately regulated AI according to the risks of its use rather than the technology itself, which left a gap around general-purpose models that could underpin thousands of downstream applications. As Future of Life Institute and other stakeholders warned in the August 2021 consultation, that hole was spotted early; ChatGPT simply made it politically impossible to ignore. Rather than freezing the original proposal, the process adapted, moving from the Slovenian and French presidencies through the Parliament's tiered foundation-model regime to the December 2023 trilogue, which produced layered GPAI obligations alongside a voluntary Code of Practice. Consequently, while these duties have applied since August 2025, the real test arrives on 2 August 2026, when enforcement powers begin.

Parliament considers single digital regulator to oversee EU tech rules: Pieter Haeck from POLITICO describes how the European Parliament will prepare a report on whether the EU should establish a single digital regulator to centralise enforcement of the bloc’s technology rules. According to a document dated 15 July, lawmakers in the Parliament’s legal affairs committee have decided to write an own-initiative report on “the case for a European Digital Enforcement agency”. While such reports carry no legal force, they often allow lawmakers to advance a policy or influence the Commission’s thinking. At present, enforcement of rules such as the Digital Services Act, the Digital Markets Act and the AI Act is spread across several Commission services and member-state authorities. Because these rules have faced criticism from both the US government and industry, there have been calls to centralise enforcement outside the Commission to shield it from political pushback. Finally, German Greens lawmaker Sergey Lagodinsky made the pitch, with other groups supporting it pending a change to the report’s title.

Legislative Process

New EU plan to address the risks and opportunities of advanced AI for cybersecurity: The European Commission sets out a plan to manage the risks and seize the opportunities of advanced AI in cybersecurity. While AI can strengthen security, it can also be misused to find vulnerabilities, automate attacks, and increase the scale and speed of cyber incidents. Accordingly, the plan brings together member states, industry and EU-level organisations. Among its key actions, the Commission will help build an EU evaluation capacity to support the AI Office, work with ENISA to define a blueprint for structured access to advanced models, and create a secure testing platform for cybersecurity with the Joint Research Centre. Furthermore, it calls for stronger cyber hygiene, greater use of AI to fix vulnerabilities, and continued investment through AI Factories, Gigafactories, and a new EU Grand Challenge on AI for cybersecurity. The plan builds on existing rules, including the AI Act, the Cyber Resilience Act, the Network and Information Systems Directive and the Cyber Solidarity Act.

Council gives final green light to simplify and streamline rules: The Council has given final approval to a regulation streamlining certain AI rules as part of the ‘Omnibus VII’ simplification package. Because provisions on high-risk AI systems were due to apply from 2 August 2026, co-legislators prioritised this element and agreed new dates, namely 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for those embedded in products. Alongside this delay, the law adds a provision banning the generation of non-consensual intimate content and child sexual abuse material from December 2026. Furthermore, it postpones the deadline for national regulatory sandboxes to 2 August 2027 while shortening the transparency grace period for generative AI systems already on the market to 2 December 2026. Finally, it clarifies the AI Office’s supervisory competences, listing exceptions where national authorities remain responsible.

Analyses

EU enforcement powers to ensure frontier AI models are safe and secure: In an open letter to the European Commission President Ursula von der Leyen and Executive Vice-President Henna Virkkunen, a coalition of AI researchers, civil society organisations and independent experts, including academics Yoshua Bengio and Stuart Russell, express support for the Commission as it prepares to enforce the AI Act’s rules for general-purpose AI models with systemic risk from 2 August 2026. Noting that systemic risks are beginning to materialise and that other jurisdictions, including the US, are following the EU’s approach, the signatories argue that a year on from the finalisation of the Code of Practice, rapid developments make enforcement more urgent than ever. In particular, they point to widely reported cyber-offence capabilities in Anthropic's Mythos model and fast-approaching critical thresholds for biology and loss of control. Accordingly, they first urge the Commission to make full use of its powers under Articles 91, 92, 93 and 101. They also ask it to empower the AI Office's Network of Evaluators to carry out external assessments, and call for the Office to be given adequate resources and political backing.

Nobody gets an A in the latest AI safety rankings: Harry Booth, a reporter at TIME, reports on the latest AI Safety Index published by the Future of Life Institute, which asks an expert panel to grade AI firms on how seriously they manage risk, from pre-deployment testing to plans for controlling ever-more-powerful systems. The grades are unforgiving: Anthropic held the top spot with a modest C+, while OpenAI slipped from C+ to C, narrowly ahead of Google DeepMind in third place. All three, the panel noted, have weakened or dropped earlier pledges to halt development at certain red lines and softened their resistance to military uses. Meanwhile, Meta climbed from D to D+, and Elon Musk’s xAI fell to an F, joining DeepSeek and Mistral. According to Max Tegmark, a genuine “race to the top” will ultimately require regulation, pointing to the EU AI Act, Chinese rules taking effect later this month, and a more risk-conscious US administration.

What is the Scientific Panel and how does it work? The Future of Life Institute’s AI Act website explains that the Scientific Panel of independent experts is a body established under the EU AI Act to support the enforcement of rules on general-purpose AI models and systems. Within the Act’s governance architecture, it sits as one of three advisory bodies, alongside the AI Board and the Advisory Forum. It advises the AI Office and national authorities on systemic risks, model classification, evaluation methodologies and cross-border market surveillance. Established by Article 68, with detailed arrangements set out in Implementing Regulation, the Panel consists of up to 60 independent experts serving two-year renewable terms, selected for gender balance and geographical representation. Appointed on 1 June 2026, its members chiefly advise and support the AI Office, while also being empowered to request information and issue qualified alerts about possible Union-level systemic risks.

The EU AI Act and agentic AI: Vik Khurana, Partner, and Camille Beckmann, Associate, at Bristows examine the challenges of applying the AI Act to agentic AI, arguing that agentic systems are more likely than previous paradigms to engage the Act’s key requirements. Although the Act contains no specific definition of “AI agent”, they note that the functional, technology-neutral definition in Article 3(1), resting on autonomy, adaptiveness and the capacity to generate outputs influencing environments, almost always applies. Consequently, classification questions concern how many systems a deployment contains and which regulatory tier each falls into. Because agents change after deployment, the concept of “substantial modification” is especially likely to be triggered. The authors further explain why compliance becomes harder: the Article 14 human oversight requirement sits in tension with agents’ reduced human involvement, documentation and conformity assessments assume fixed functions, and the Article 50 transparency obligations may not reach people who never chose to interact with AI.

Legislative Process

EP approves simplification measures and “nudifier” app ban: The European Parliament has granted final approval, by 423 votes to 57 with 174 abstentions, to amendments to the EU AI Act under the digital omnibus package. Most notably, the legislation postpones obligations on high-risk AI systems, which will now apply from 2 December 2027 for stand-alone systems and from 2 August 2028 for those embedded as safety components covered by EU sectoral legislation. Alongside this, watermarking obligations on AI-generated content are delayed until 2 December 2026 for systems placed on the market before 2 August 2026. The law furthermore bans AI systems generating child sexual abuse material or non-consensual intimate imagery, giving companies until 2 December 2026 to comply. Additional changes streamline requirements for machinery, clarify the “safety component” definition, permit bias-detection data processing, and extend SME exemptions to small mid-caps.

EU icons for labelling AI-generated content: The European Commission has developed a set of icons that creators, publishers and other deployers of generative AI systems may use to label their AI-generated content, in line with the AI Act’s transparency rules. These freely available icons, a key component of Section 2 of the Code of Practice on marking and labelling AI-generated content, aim to help people recognise artificially generated or manipulated content, thereby supporting public trust and reducing the risk of misinformation. The icons specifically support compliance with Article 50(4), which requires disclosure of deep fakes and certain published text on matters of public interest. However, exceptions apply to evidently artistic or satirical works, uses authorised by law, and text subject to human editorial control. While the icons are optional, the labelling obligations themselves are not, and the use of these icons does not by itself establish legal compliance.

Code of Practice on Transparency of AI-Generated Content FAQs: Two sets of frequently asked questions published by the European Commission explain the Code of Practice on Transparency of AI-Generated Content, released in June 2026, which helps providers and deployers of generative AI systems comply with the AI Act’s obligations for labelling and marking such content. The first set sets out what the Code is, how it was drafted and who was involved, how providers and deployers can adhere to it and the benefits, whether it imposes obligations beyond the AI Act, and its interplay with the forthcoming Article 50 Guidelines. The second set then addresses the signing process, covering eligibility, how to sign, the submission deadline, who should sign the form, whether providers can join after 22 July 2026, the rationale for the Commission and Board assessments, partial participation, the benefits, the consequences of not signing, and how signatories may withdraw.

Analyses

Cate Blanchett launches Human Consent Registry in European Parliament: Maximilian Henning, Euractiv tech reporter, describes how Oscar-winning actress Cate Blanchett unveiled a tool in the European Parliament to allow people to declare whether, and under what conditions, AI systems may use their likeness. The initiative speaks to longstanding disputes over AI models that draw on people’s identities or work without permission, which have prompted creatives to sue firms such as OpenAI and to demand new rules. Blanchett praised the AI Act for demonstrating that innovation and rights can coexist, arguing that consent is not an obstacle to creativity. Her “Human Consent Registry” lets individuals signal, in machine-readable form, whether AI companies may use their likeness or should ask or pay first. However, she acknowledged that the registry is voluntary, so companies must agree to honour it, though she suggested it could later become part of the practical infrastructure supporting binding laws.

How to fix European Union artificial intelligence regulation: Mario Mariniello, Bruegel Non-resident Fellow, argues that EU AI regulation should trade a lower ex-ante burden for robust ex-post monitoring, judicial review and liability in order to curb harms without stifling markets. He explains that the AI Act was conceived as a traditional ex-ante product safety regulation, requiring AI systems to meet certain requirements before deployment. However, because AI operates in unknown environments and takes unforeseen actions, he contends that such an ex-ante regime cannot effectively safeguard against unforeseeable harm and risks replicating the GDPR’s contribution to market concentration by disproportionately burdening smaller firms. To rebalance the regime, he proposes revising the Act towards a mix of ex-ante and ex-post measures, reducing compliance costs for most suppliers while introducing ex-post judicial review grounded in an ad-hoc AI liability framework, alongside new monitoring and enforcement tools.

The AI Transparency Code of Practice explained: Natalia Garina, legal researcher and consultant, examines in Tech Policy Press the final version of the Code of Practice on Transparency of AI-Generated Content. She explains that the Code, developed by independent experts in a multi-stakeholder process coordinated by the AI Office, supports compliance with the transparency obligations under Article 50 of the AI Act. Once endorsed by the Commission and AI Board, signatories may rely on it to demonstrate compliance. However, Garina notes that adherence remains voluntary and is no guarantee of compliance. She also cautions that the Code leaves several issues unresolved, since key concepts rely on case-by-case assessments rather than clear criteria, and the Code itself acknowledges current technological limitations in marking and detection tools.

Potential avenues for redress for AI-related harms under the GDPR: Laura Lazaro Cabrera and Magdalena Maier of CDT Europe explore how the General Data Protection Regulation can provide redress for AI-related harms, given that the AI Act itself offers only limited remedies and largely relies on other areas of EU law. As a tech-agnostic law, they explain, the GDPR applies wherever personal data is processed, which makes it valuable in edge cases where technologies may not clearly meet the AI Act’s contested definitions. Notably, the GDPR bans consequential decisions based solely on automated processing, a prohibition broader in scope than the AI Act’s, subject to some exceptions. Regarding the right to an explanation, the authors observe that the two regimes complement one another, though the AI Act confines this right to a finite set of high-risk deployments.

Legislative Process

AI Act Scientific Panel announced: The European Commission has established the Scientific Panel as an expert advisory body under Article 68 of the AI Act to support the implementation and enforcement of the AI Act. To this end, 60 world-class independent AI experts have been appointed to advise the AI Office and national authorities on implementation and assessment of the impacts and risks of General-Purpose AI (GPAI) models. Their core responsibilities include alerting the AI Office to systemic risks, advising on GPAI classification and evaluation methodologies, and supporting market surveillance activities, a role that complements the broader stakeholder input provided by the Advisory Forum. The selected experts span fields such as GPAI capability evaluation, risk assessment, technical mitigations, misuse and cyber offence risks, provider cybersecurity, and compute measurement. Appointed in their personal capacity for a renewable two-year term, they were chosen with attention to geographic and gender balance, with a chair and vice-chair to follow.

AI Act Advisory Forum: Alongside the Scientific Panel, the European Commission has established the Advisory Forum under Article 67 of the AI Act as a general advisory body to the Commission and the AI Board, supporting the implementation and enforcement of the AI Act. Selected from more than 700 applications, the 174 members are drawn from civil society, academia and industry, including SMEs and start-ups, and they provide technical expertise on a broad range of matters, such as standardisation and implementation challenges. Serving two-year terms that are renewable once, members are expected to engage actively in plenary meetings and thematic subgroups and to offer opinions, recommendations and written contributions at the request of the AI Board or the Commission. Permanent members include the Fundamental Rights Agency, ENISA, CEN, CENELEC and ETSI, with the AI Office able to invite further stakeholders as observers.

Commission publishes Code of Practice on marking and labelling AI-generated content: The European Commission has published the final Code of Practice on marking and labelling of AI-generated content, a voluntary instrument that sets out practical steps to help providers and deployers of generative AI systems meet the AI Act transparency obligations applying from 2 August 2026. Deepfakes and AI-generated or AI-manipulated text published on matters of public interest must be clearly marked, while users must also be informed when they are interacting with an interactive AI system such as a chatbot. The Code was drafted by six independent experts with input from more than 180 stakeholders, ranging from providers and deployers to SMEs, academia, the public sector and civil society. It is organised into two sections, one addressing how providers should mark generated or manipulated content in a machine-readable way, and another explaining how deployers must label deepfakes and public-interest text produced without human review. Complementing the rules on general-purpose AI and high-risk systems, the Code is now open for signatures and will be accompanied by Commission guidelines clarifying the scope of the obligations.

Ireland targets AI Omnibus and child safety in EU presidency agenda: Liz Carolan, a fellow at Tech Policy Press, examines the government policy programme published by Helen McEntee, Ireland’s minister for foreign affairs, ahead of the country’s rotating presidency of the Council of the European Union. The 68-page document, which expands on three themes McEntee set out earlier this year — competitiveness, values and security — signals an intention to aggressively roll back parts of the EU’s digital regulatory framework during the six-month term beginning 1 July, while also advancing measures on child online safety, justice and migration. In pursuing the EU’s “simplification agenda”, the programme adopts the framing that “simplification is about better regulation, not deregulation”, thereby acknowledging concerns from civil society and some member states. For Ireland, the most immediate task is the Digital Omnibus on AI, a package of amendments to the AI Act; although the Parliament and Council reached a provisional agreement in May, it has not yet been formally adopted. Without approval, the original high-risk compliance deadline of 2 August 2026 remains, whereas the Omnibus would push it back to December 2027 at the earliest and loosen protections around personal data use.

Analyses

Latin America follows EU model on regulation: Journalist Ann Deslandes reports in International Bar Association on how Chile is emerging as a regional leader, having spearheaded the February launch of Latam-GPT, the first open-source AI language model trained on Latin American data. As countries weigh whether to draw inspiration from the EU or the US, recent initiatives suggest a tilt towards Europe: Peru classifies AI systems by risk to human rights, while Brazil, El Salvador and Chile have advanced similar measures. According to IBA Latin American Regional Forum officers Jose Luis Ambrosy and Patricia Silberman, the region’s data protection and cybersecurity rules resemble the EU’s horizontal, risk-based, rights-focused model more than the lighter-touch US approach. Nevertheless, Andrea Saffie warns that following the EU risks over-regulation that strains under-resourced regulators and SMEs, compounded by the region’s legal heterogeneity and differing priority sectors.

Why the EU rewrote its landmark AI law: Peder Schaefer of The Parliament Magazine traces how Ursula von der Leyen’s framing shifted from a law that would “transpose European values to a new era” to one creating “a simple, innovation-friendly environment”. The amendments finalised on 7 May postponed high-risk rules until 2027 or 2028 and removed industrial applications altogether, yet, crucially, left the August timetable for general-purpose AI models intact. Accordingly, Interface researcher Nicole Lemke argues the risk-based architecture endures, while MEP Axel Voss contends the only substantial deregulation was the industrial carve-out. Supporters of the changes cite European competitiveness as the motivation, though it is worth noting that the Act has barely been implemented and no fines have been issued under it; Luka Ignac from Centre for Future Generations, meanwhile, attributes weak European AI innovation more to scarce capital and market fragmentation. The steepest test arrives on 2 August, when enforcement of general-purpose AI rules begins.

Legislative Process

Targeted consultation on the draft guidelines for the classification of high-risk artificial intelligence systems: The European Commission has opened a targeted consultation, running until 23 June 2026, to gather feedback on the clarity of its draft guidelines and the usefulness of the accompanying examples for classifying high-risk AI systems under the AI Act. The guidelines are designed to assist providers, deployers and other relevant actors in determining whether a given AI system falls within the high-risk category, offering clarifications on the relevant provisions of the AI Act alongside practical examples that illustrate how classification should be approached across different areas and use cases. The Commission is welcoming input from AI providers and developers, organisations using AI systems, public authorities, researchers, civil society organisations, supervisory bodies and members of the public.

FAQ on general-purpose AI models: The European Commission’s AI Office has published a frequently asked questions page on general-purpose AI (GPAI) models, compiled from queries received during the AI Pact webinars and stakeholder submissions. The FAQ covers a broad range of topics, including how GPAI models and systems are defined, when systemic risk applies, and how the compute threshold interacts with systemic risk classification. It also addresses questions on provider identity, including what happens when a model is modified by a different actor, as well as obligations for open-source models, energy consumption documentation, serious incident reporting, and the GPAI Code of Practice. For example, it clarifies that technical compliance dialogues have been the AI Office's primary tool since last year and will continue and, if anything, intensify after August. Formal powers will be used where such dialogues prove insufficient.

Poland adopts draft AI regulatory bill in move to comply with EU rules: Eric Kliszcz, journalist at TVP World, reports that the Polish parliament’s Committee on Digitalization, Innovation and Modern Technologies has adopted a draft AI bill designed to align national rules with the AI Act. At the heart of the proposal is the establishment of a national oversight body, the Commission for the Development and Security of Artificial Intelligence (KRiBSI), which would be empowered to inspect companies, verify compliance, impose penalties and order non-compliant systems to be withdrawn from the market. In addition, the commission would issue permits for high-risk AI systems in areas such as education, critical infrastructure, employment and migration management, and would set up regulatory sandboxes for controlled testing. Regarding governance, the body would be led by a chairperson appointed by parliament with the Senate’s consent, supported by two deputies and representatives of several existing regulators, and would cooperate with national authorities.

Analyses

How much power does the EU AI Office actually have? Joel Christoph, fellow at the Harvard Kennedy School, writes in Lawfare that on 2 August the European Commission’s AI Office will gain three significant enforcement powers over providers of general-purpose AI models. Under Article 91, the Office can demand technical documentation, training data summaries and model reports, while Article 92 allows it to commission independent evaluations, for instance, through the Scientific Panel, including access to the model via APIs or other technical means. Building on these, Article 93 enables the Office to require providers to take specific actions, such as mitigation measures or, in extreme cases, the restriction, withdrawal or recall of a model from the market. Backing these powers, Article 101 authorises fines of up to 3 percent of global annual turnover for failures to comply with information or evaluation requests. Christoph highlights that early sequencing choices, the differential treatment of Code of Practice signatories, and use of the structured dialogue mechanism will shape how seriously providers and other jurisdictions take the EU’s approach.

A practical guide to Article 50 on transparency: Future of Life Institute's guide on the EU AI Act website explains that Article 50 of the AI Act introduces transparency obligations on providers and deployers of certain AI systems, applying not only to high-risk systems but to any AI system used in four specific situations, with open-source systems not exempt. More precisely, the obligations cover AI that interacts directly with people, AI that generates synthetic content, AI used for emotion recognition or biometric categorisation, and AI that creates deepfakes or text published on matters of public interest. On the provider side, chatbots and virtual assistants must be designed so that users know they are interacting with AI, while outputs of generative systems must be marked in a machine-readable format and detectable as artificially generated, with a standardised EU label under development. As for deployers, those using emotion recognition or biometric categorisation must inform exposed individuals, and deepfakes or AI-generated text on matters of public interest must be disclosed unless subject to human editorial review.

Will AI regulatory sandboxes work? Sriya Gukal, writing in The Regulatory Review, examines the EU’s attempt to let companies test AI systems on real people under regulatory supervision before market release. As Gukal explains, the AI Act introduced regulatory sandboxes when it entered into force in August 2024, allowing prospective providers to develop, train, validate and test innovative AI systems for a limited period under supervision. Their documentation is usable to demonstrate compliance and protect them from administrative fines if they follow national authority guidance in good faith. In December 2025, the Commission launched a stakeholder consultation on a draft implementing law setting out common rules for sandboxes. Sandbox proponents point to one major study which found that participants raised significantly more capital than comparable non-participants, and they argue that sandboxes generate valuable regulatory knowledge through annual reports to the AI Office. Critics, however, question the empirical record, warn that SMEs may struggle despite free access, and note that participants remain fully liable for third-party damages. Reflecting these tensions, the Digital Omnibus provisional agreement of May 2026 pushed the establishment deadline from August 2026 to August 2027.

Legislative Process

EU agrees to simplify AI rules to boost innovation and ban ‘nudification’ apps to protect citizens: The European Commission welcomes the political agreement reached between the European Parliament and the Council of the EU on the Digital Omnibus on AI. Under the deal, rules for high-risk AI systems will apply from 2 December 2027. Rules for systems embedded in products like lifts or toys will apply from 2 August 2028. In addition, the agreement prohibits AI systems generating non-consensual sexually explicit content or child sexual abuse material, including ‘nudification’ apps. For businesses, certain SME privileges are extended to small mid-caps, the interplay with the Machinery Regulation is clarified, and access to regulatory sandboxes, including an EU-level one, is broadened. The AI Office’s enforcement powers are also strengthened, particularly over general-purpose models and systems embedded in very large online platforms and search engines. The Parliament and Council must now formally adopt the agreement, after which it will enter into force three days following publication in the Official Journal.

Commission opens consultation on draft guidelines for AI transparency obligations: The Commission has published draft guidelines on the AI Act’s transparency obligations and opened them up for stakeholder feedback. From 2 August 2026, people in the EU will have to be informed when they are interacting with an AI system or exposed to certain AI-generated or manipulated content. More specifically, providers will be required to inform users when they are interacting with an AI system and to add machine-readable marks enabling the detection of AI-generated or manipulated content. Deployers will additionally have to inform people when they are exposed to deep fakes, AI-generated publications on matters of public interest, and emotion recognition or biometric categorisation systems. Drawing on input from earlier consultations, the draft guidelines seek to clarify the scope of these obligations and help providers and deployers comply. They will be complemented by a voluntary code of practice drafted by independent experts and expected in June 2026. Stakeholders are invited to share their views by 3 June 2026.

Europe’s laws ‘ill-equipped’ to deal with superhacking AI, lawmakers warn: Sam Clark from POLITICO reports that, in a letter obtained by the outlet, 30 MEPs from six political groups told Commission Executive Vice-President Henna Virkkunen that the EU’s cybersecurity rules are ill-equipped to deal with a new generation of AI hacking tools such as Anthropic’s Mythos, and that the bloc needs to revise its laws and put together a “European mitigation plan”. The warning follows Anthropic’s announcement last month that its model outperformed humans in finding and exploiting security vulnerabilities. Although Parliament’s internal market committee invited Anthropic to a public hearing, the company said it was unable to accept at short notice. In their letter, the lawmakers urged reform of the EU’s rules on the disclosure and remediation of cyber flaws, called on the Commission to prioritise protection of “crown jewels” such as critical sector operators, and pushed for EU cyber agency ENISA to gain access to Mythos and other models to scrutinise the risks. In response, Commission spokesperson Thomas Regnier said the Commission has held numerous technical meetings with Anthropic since August 2025, as well as several meetings specifically about Mythos. He added that “once the enforcement powers of the AI Office start in August 2026, we will ensure to receive, if needed, model access.”

Analyses

Access is not safety: the real Mythos question Europe isn’t asking: I argue in a LinkedIn op-ed that the Brussels debate over whether the European Commission and the AI Office have access to Anthropic’s Mythos model risks putting the second question first, and that the more fundamental issue is whether Anthropic can mitigate the systemic risks of a superhacking model and why a private company is permitted to develop and deploy such capabilities without binding, independently verified pre-deployment oversight. I stress that the AI Act, and in particular its Article 55 obligations on systemic risks from general-purpose AI models, gives Europe a basis for requiring providers to release a model only when it is adequately safe, and that the General-Purpose AI Code of Practice was designed precisely for capabilities like this. A serious European response, in my view, would make notification and pre-market engagement for systemic-risk models non-negotiable, invest in the AI Office’s technical capacity and independent evaluators, and be willing to refuse market entry when a provider cannot demonstrate that mitigations are adequate and verifiable prior to deployment. I conclude that the “Europe doesn’t have access” narrative recasts a safety question as a competitiveness one, and that access alone will only address the underlying risk if Anthropic are held to account once systemic risk obligations for general-purpose AI become enforceable on 2 August 2026.

The EU AI Act is not ready for agents: Kathrin Gardhouse and Amin Oueslati, both at The Future Society, argue in Tech Policy Press that AI agents, systems which independently pursue complex goals with limited human oversight, have entered the mainstream but introduce unique risks that the EU AI Act was not written to address. They illustrate the point with recent incidents, including Amazon’s coding agent Kiro deleting a live production environment in December 2025 and triggering a 13-hour AWS regional outage. While the Act applies to agents in principle, the authors contend it falls short in practice across several governance challenges in areas relating to performance, misuse, privacy, equity and oversight. For example, while metrics such as robustness remain relevant, others such as accuracy map poorly onto agents, since accuracy presupposes a determinate correct output that agentic tasks often lack. To close these gaps, the authors call for harmonised standards accounting for agentic capabilities before the high-risk obligations come into force, and AI Office guidance for general-purpose models with systemic risks, whose obligations already apply but remain vague.

Legislative Process

EU legislators fail to clinch deal to delay AI law: Pieter Haeck from POLITICO describes how EU legislators failed to agree on a rollback of the bloc’s AI rules, with requirements for machinery and medical devices emerging as the main sticking point. After hours of talks, negotiators from the European Parliament and EU countries parted ways without a deal that would have delayed a key part of the AI Act until December 2027 and banned AI nudification apps, and no date has been set to resume discussions. Because new rules for high-risk AI applications are due to apply this August, the collapse tightens the timeline to avoid legal uncertainty. At the heart of the dispute, the centre-right in Parliament, backed by Germany, is pushing to let products such as machinery and medical devices comply with sectoral law rather than the AI Act, a move opposed by several member states and the centre-left.

Merz’s coalition partner opposed his push to cut EU’s AI rules: Maximilian Henning, reporting for Euractiv, reveals that German Chancellor Friedrich Merz was not aligned with his coalition partner, the Social Democrats, in his last-ditch push to cut the EU's rules for industrial AI. The debate gained prominence on the night after Parliament and Council failed to agree on a deal to "simplify" the AI Act, with Merz's EPP pressing for the cuts he had previously advocated for in Parliament, describing EU rules as a "corset" on industrial AI. Just a day before the supposedly final trilogy, Social Democrat group in Germany’s parliament sent a letter to its European lawmakers titled “VERY URGENT! Trilogue on AI Digital Omnibus”. They urged opposition to any weakening of the AI Act’s horizontal approach and warned that the proposed changes would bring significant risks, create inconsistent rules, lead to gaps in protections and be better for foreign companies than for European ones.

European Parliament invites Anthropic to hearing on Mythos model: Turning from the trilogue, Haeck reports for POLITICO that the European Parliament's internal market committee has invited Anthropic to a hearing on Wednesday on the superhacking Mythos model, which the company decided not to release over fears it could exploit software vulnerabilities. According to a draft agenda, the hearing will address the "safety and cybersecurity risks potentially posed by advanced AI systems" and their relation to EU regulation, with Anthropic's head of public policy Sarah Heck, EU tech chief Henna Virkkunen, AI Office boss Lucilla Sioli and a representative from ENISA all invited.

Anthropic briefed Commission on Mythos’ cyber risks: In a related POLITICO piece co-authored with Kathryn Carlson, Haeck adds that the Commission has received more information directly from Anthropic, with spokesperson Thomas Regnier stating that the company briefed the EU executive on “technical details around the cyber capabilities and risks” of the model, whilst both sides also addressed Project Glasswing, a coalition of trusted tech and cyber firms assembled by Anthropic to patch vulnerabilities. More broadly, Anthropic is in regular contact with the EU’s AI Office, as it has signed on to the EU’s set of best practices for the most complex and advanced models, under which it is expected to address and mitigate cybersecurity risks.

Analyses

How the EU and UK can learn from Anthropic’s Mythos: Jimmy Farrell, EU AI Policy Co-Lead for Pour Demain, argues in Tech Policy Press that Anthropic's Claude Mythos Preview marks a significant jump in the ability of AI to automate complex cyber-attacks, having uncovered thousands of vulnerabilities in critical internet infrastructure and becoming the first model to autonomously complete all 32 steps of the UK AI Security Institute's corporate network attack simulation. In response, UK AISI published comprehensive cyber-capability testing within six days, followed by a UK government letter to business leaders, although Farrell notes this approach still relies on the voluntary goodwill of providers. By contrast, the EU's AI Act already addresses systemic risks from offensive cyber capabilities along the entire model lifecycle, including pre-training, giving the AI Office a legal basis to seek some oversight over Mythos if it is planned for deployment in the EU market. Farrell therefore recommends combining UK-style technical expertise with EU regulatory power and strengthening institutional tools such as the Scientific Panel, Advisory Forum and third-party evaluations, whilst calling for stronger international standards given that OpenAI has announced a comparably capable model, GPT-5.4-Cyber, to be released less restrictively.

The EU AI Office must prioritise setting up the Advisory Forum: 35 organisations and researchers are calling on the EU AI Office to clarify the timeline and process for establishing the Advisory Forum, the only formal mechanism ensuring civil society voices are part of AI Act implementation. Although the call for expression of interest closed in September 2025, seven months later the Forum has still not been established and no clear timeline has been shared despite requests. In the meantime, the signatories warn that discussions on issues such as prohibited uses, high-risk classification and fundamental rights obligations take place largely between EU institutions and Brussels-based stakeholders, risking the exclusion of underrepresented perspectives. Furthermore, they believe the Forum’s absence has been a missed opportunity to rigorously test the AI Omnibus. This debate has so far been confined to “Reality Checks” involving a small, predominantly industry-focused group. Consequently, they urge the AI Office to prioritise establishing the Forum and fostering meaningful civil society participation beyond it.

AI Act could force universities to ‘change everything’: Seher Asaf, Europe reporter at Times Higher Education, writes that many European universities may have to change everything about how they use AI once the AI Act's provisions come into force, according to Thomas Jørgensen of the European University Association. In particular, Jørgensen singled out the growing practice of academics using tools such as ChatGPT to assess student work. He cautioned that such informal applications could potentially violate the legislation. The Act mandates a range of requirements for both users and providers when AI is used for assessment and large language models might not meet transparency and training data criteria. Moreover, he noted that these compliance challenges would extend to universities that have set up their own formal AI tools, although clarity remains limited until guidelines from the AI Office are published. Looking further ahead, he warned that widespread reliance on the same US-trained commercial models across Europe risked eroding intellectual diversity, pointing to European alternatives such as EuroLLM given that "the big US models don't really cut it for us".

Tools & Resources

A new AI Act Explorer (BETA): Built and maintained by the Future of Life Institute, the updated AI Act Explorer offers a navigable interface to the text of the AI Act, with features including the ability to compare provisions across languages, and now also covering implementation instruments such as the Scientific Panel and the Code of Practice. Readers can use it as a companion resource when following the implementation developments covered in this edition, whilst bearing in mind that this is a BETA product currently hosted at explorer.artificialintelligenceact.eu and that this is not the final URL of the web tool.

This is the 100th edition of the newsletter. To mark the occasion, I've opened an Ask Me Anything in the Substack chat – questions, reflections and predictions all welcome.

Legislative Process

Building AI the European way: Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, reflects on the first year of the Commission’s AI Continent Action Plan, which was built around five pillars: infrastructure, data, skills, adoption and simplification. On the infrastructure side, 19 AI Factories have been deployed across European supercomputers, whilst the proposed AI Gigafactories concept has already attracted 76 expressions of interest spanning 16 Member States. Turning to adoption, €1 billion in funding calls has been mobilised for strategic sectors, alongside targeted initiatives such as AI-powered cancer and cardiovascular screening centres and a Grand Challenge competition to develop sovereign European AI models. Meanwhile, the AI Omnibus, delivered in November, seeks to adjust the the AI Act's timeline and address implementation challenges. Virkkunen frames these together as a distinctly European approach that manages risk whilst encouraging innovation. Finally, she announces a forthcoming tech sovereignty package focusing on data centre capacity and AI chip production.

Analyses

Cambridge Commentary on EU General-Purpose AI Law: The Leverhulme Centre for the Future of Intelligence at the University of Cambridge and the Institute for Law & AI have launched the first scholarly commentary devoted exclusively to the GPAI model provisions of the AI Act. Given the regulatory uncertainties surrounding these models – particularly those posing systemic risk – the editors argue that rigorous legal analysis is especially consequential. Rather than advocating a single preferred interpretation, the Commentary maps the interpretive landscape for each provision, identifying where the law is clear, where ambiguity exists, and what the strongest arguments on each side look like. It launches with Chapter V, with further articles to follow on a rolling basis.

Reclaiming Europe’s AI narrative: Kleitia Zeqo, Principal Consultant at Technopolis Group, argues that Europe’s AI ecosystem is frequently underestimated, despite the continent hosting a substantial number of AI companies, the largest share of AI research players globally, and deep engineering talent in France, Germany and the United Kingdom. Against this backdrop, the AI Act serves not as a brake on innovation but as institutional infrastructure offering three structural advantages: first, a single regulatory framework across 27 Member States, in contrast to over 35 fragmented state-level AI-related acts in the US; second, a risk-based approach targeting only high-impact use cases whilst leaving most applications largely unregulated; and third, demonstrated adaptability through initiatives such as the multi-stakeholder Code of Practice for general-purpose AI models. Beyond competitiveness, Zeqo stresses the importance of addressing systemic and sociotechnical risks, arguing that effective governance ensures deployment remains controllable, accountable and socially sustainable.

European regulators sidelined on Anthropic model: Pieter Haeck and Sam Clark from POLITICO report that Anthropic has decided to limit the release of its latest model, Mythos, which it claims can surpass most humans at finding and exploiting cyber vulnerabilities. The company handpicked 12 US-headquartered tech firms, including Apple, Microsoft and Amazon, as its closest partners, while also granting access to the UK's AI Security Institute for testing. By contrast, POLITICO found that of eight European national cyber agencies contacted, only Germany's had entered into conversations with Anthropic, and none had been able to test the model. Several experts expressed concern: Yoshua Bengio called it "deeply concerning" that private companies rather than regulators decide how to handle such risks, whilst former MEP Marietje Schaake warned against models with far-reaching impact being governed privately.

Open joint letter on AI Office resourcing: A coalition of civil society organisations, industry representatives and individual experts has written to Executive Vice-President Henna Virkkunen calling for adequate resources and the removal of administrative bottlenecks for the EU AI Office. The letter draws a stark comparison with DSA enforcement, which covers around 26 designated services with €50 million in annual funding and 160 staff, whereas the AI Office Unit A3, responsible for overseeing GPAI models with systemic risk, is planned to reach only around 40 staff. The signatories call for €100 million annually for Unit A3 and a gradual increase to a minimum of 100 staff by 2030, alongside more flexible administrative conditions such as permanent contracts, higher salaries and remote-work allowances to attract top frontier AI talent. The letter frames adequate resourcing not only as essential for the health, safety and fundamental rights of EU citizens, but also as a strategic investment in European competitiveness and sovereignty.

Responding to criticisms of the Annex I merger: DIGITALEUROPE addresses what it describes as factual inaccuracies circulating among parts of the certification industry, civil society and the Commission over the proposed merger of Sections A and B of Annex I. Under the current structure, Section A products, such as machinery, medical devices and radio equipment, must comply with both the AI Act’s high-risk obligations and their existing sectoral frameworks in parallel, whereas Section B products face AI Act requirements only once sectoral law has been updated. The merger, adopted by Parliament on 26 March 2026, would bring all New Legislative Framework-covered products under the Section B approach. DIGITALEUROPE emphasises that this does not amount to deregulation but consolidates two overlapping compliance pathways, that all high-risk obligations remain intact, and that the Section B model already exists within the Act.

What's Next?

AI Omnibus timeline overview: Kai Zenner, Head of Office and Digital Policy Adviser to MEP Axel Voss, published an overview of the AI Omnibus legislative schedule. The trilogue negotiations are entering their final stretch, with EU policymakers racing to conclude before the AI Act’s high-risk obligations take effect on 2 August 2026. Following the Parliament’s plenary vote on 26 March, interinstitutional technical meetings have been taking place throughout April, with the second political trilogue planned for Tuesday 28 April. If an agreement is reached, the timeline foresees an IMCO/LIBE committee vote in May, a plenary vote in June, and publication in the Official Journal in July, just days before the August deadline.

Legislative Process

MEPs agree on proposals to simplify AI rules: The European Parliament adopted its position on an AI Act simplification proposal with 569 votes in favour, 45 against and 23 abstentions. Notably, the proposal delays rules for high-risk AI systems to allow implementation guidance and standards preparation. MEPs introduce fixed application dates: 2 December 2027 for high-risk systems and 2 August 2028 for systems covered by EU sectoral safety legislation. Additionally, MEPs grant providers until 2 November 2026 for watermarking compliance. They’re introducing a ban on “nudifier” systems that create or manipulate sexually explicit images of identifiable people without consent. This excludes systems with effective safeguards. Furthermore, MEPs permit personal data processing to detect and correct biases in AI system provided strict necessity safeguards are in place. They back extending SME support measures to small mid-cap enterprises. MEPs argue that AI Act obligations can be less stringent for products already regulated under sectoral laws. Following the Parliament’s adoption, negotiations with the Council on the law’s final form can now begin.

Analyses

Beyond “US Innovates, Europe Regulates”: Julia Tréhu, Program Manager and Fellow, and Adrienne Goldstein, Senior Program Coordinator, at the German Marshall Fund of the United States, reported on a bipartisan US state lawmakers delegation's December 2025 study tour to Paris and Brussels. They met European Parliament members, Commission staff, civil society, innovators and researchers to examine AI governance approaches. The study identified three key findings: 1) children’s safety and high-risk AI redlines represent clearest areas for near-term transatlantic policy alignment, warranting an AI dialogue; 2) structural barriers to AI competitiveness extend beyond regulation across the entire AI value chain; and 3) legislators require cross-sectoral AI expertise to address whole-of-society challenges. The research challenges the “US innovates, Europe regulates” stereotype, finding shared priorities on citizen protection and competitiveness despite transatlantic tensions. The study tour identified bloc-wide competitiveness obstacles beyond regulation: fractured capital markets, venture ecosystems, energy costs, talent retention, and access to compute and datasets. Notably, the EU’s lag in AI is unlikely to be explained meaningfully by the AI Act itself, as many of its provisions haven’t yet taken effect. US companies already cooperate with EU enforcement mechanisms on data portability and interoperability.

Overview of enforcement of Chapter V: Eliška Andrš, a Policy Researcher at the Future of Life Institute, wrote an overview of the AI Act’s enforcement provisions relating to the provisions that impose obligations on providers of general-purpose AI (GPAI) models. Under the AI Act, GPAI model providers have procedural and substantive obligations. While these obligations have applied since 2 August 2025, the Commission’s supervision and enforcement powers against GPAI model providers commence on 2 August 2026. These powers include requesting documentation and information, conducting evaluations, requesting measures concerning compliance, risk mitigation, market restriction, recall and withdrawal, and imposing fines. Beyond the Commission, multiple actors enforce the AI Act against GPAI model providers. National market surveillance authorities can request the Commission to enforce regulations. Downstream providers can also lodge complaints against GPAI model providers. Furthermore, the scientific panel can alert the AI Office to any systemic or concrete identifiable risks posed by GPAI models.

Siplification will roll back our rights in order to feed AI: Amnesty International published a critical analysis arguing that the Commission’s “Digital Omnibus” proposals constitute an unprecedented rollback of digital protections, framed by advocates as “simplification” but functioning as deregulation benefiting business interests. The article states that Big Tech companies, which spend significantly on lobbying like Amazon’s €7 million annual budget, have pushed against regulation. The analysis contends that the AI Omnibus poses a significant threat to the AI Act, which is considered one of the world’s most ambitious efforts to safeguard people from AI-related harms. This is done by delaying implementation of high-risk systems. The article highlights concerns about the “grand fathering” clause permitting early deployment without full compliance obligations. The analysis suggests a planned “digital fitness check” of existing digital laws could further support deregulation.

The EU must mainstream gender in AI policy: Viktoria Henkemeier, a Junior Policy Analyst, and Samuel Goodger, a Policy Analyst at the European Policy Centre, argue that legislators are beginning to treat AI-generated gender violence as a design and governance issue, not merely a content moderation one. Gender-based digital violence, like harassment, stalking, and doxing, predates widespread AI and is generally covered by existing legislation. Crucially, AI-generated harmful content differs in quality – it can manufacture harm on a large scale and lower the barriers to real-world violence, exploiting existing gaps that current tools can’t address. Notably, the AI Act mentions gender equality but does not acknowledge gendered power structures influencing AI design, training, deployment, nor AI’s societal implications. The Code of Practice on Transparency does not mention gender and the Code of Practice on General-Purpose AI fails to classify gender-based discrimination and violence as systemic risks.

Recommendations for Digital Omnibus trilogue: A report by Marcel Mir Teijeiro and Koen Holtman at the AI Standards Lab analyses the positions of the Council and European Parliament on the AI Act Omnibus trilogue. Their main recommendations is to prioritise health, safety, and fundamental rights protections alongside reducing administrative burden. Specifically, they welcome reinstatement of Article 6(4) registration requirements, support Parliament’s proposed Article 64(2a) legally requiring AI Office resourcing, and welcome Article 75 proposals for AI Office oversight powers. Furthermore, they prefer the Council’s approach of maintaining current Annex I.A obligations over Parliament’s exclusions and support Parliament’s extension of value chain obligations to GPAI model providers under Article 25, provided these extensions exclude providers clearly stating non-high-risk intentions. Finally, the report recommends reinforcing GDPR safeguards in Article 4a, adopting Parliament’s cleaner formulation for Article 5 prohibitions on non-consensual intimate imagery and child sexual abuse material, and prioritising Parliament’s template-based post-market monitoring guidance with an earlier February 2027 deadline for Article 72(3).

Legislative Process

MEPs support postponement of certain rules: Members of the European Parliament (MEPs) adopted a joint position on simplifying the AI Act, with 101 votes in favour, 9 against and 8 abstentions. Notably, the proposal supports postponing activation of certain high-risk AI system rules, given that key standards may not be finalised by the 2 August 2026 deadline. To ensure predictability, MEPs propose fixed application dates: 2 December 2027 for high-risk systems and 2 August 2028 for systems covered by EU sectorial safety legislation. In addition, MEPs favour shorter watermarking compliance extensions until 2 November 2026. Separately, they introduce a ban on “nudifier” systems creating or manipulating sexually explicit images resembling identifiable persons without consent, excluding systems with effective safeguards. They also back extending SME support measures to small mid-cap enterprises. Following the Parliament’s plenary vote expected on 26 March, negotiations with the Council will commence.

Council agrees its position to streamline rules: The Council has agreed its position on streamlining AI rules, treating the proposal with utmost priority. Member states broadly maintain the thrust of the Commission’s proposal whilst adding some provisions. The Council mandate prohibits AI practices generating non-consensual sexual and intimate content or child sexual abuse material. Similarly to the Parliament's position, it introduces fixed application timelines with the same dates. Importantly, the mandate reinstates provider registration obligations in the EU database for systems considered exempt from high-risk classification. It postpones AI regulatory sandbox establishment until 2 December 2027. The text also clarifies the competences of the AI Office for the supervision of AI systems based on general-purpose AI models where the model and that system are developed by the same provider. Finally, the Council mandate requires the Commission to provide guidance to assist high-risk AI system operators covered by sectoral legislation in complying with AI Act requirements whilst minimising compliance burden.

Analyses

Could agents be the next stumbling block for Europe’s AI rules? Claudie Moreau and Maximilian Henning from Euractiv have highlighted that autonomous AI agents are rapidly entering mainstream adoption, raising questions about whether EU rules adequately address their capabilities. Unlike AI chatbots requiring user interaction, agents operate more autonomously, using digital tools to execute tasks. Examples include coding assistants receiving high-level instructions and “OpenClaw” agents running on scheduled intervals without user prompts. Notably, one OpenClaw agent generated headlines after apparently going rogue, attempting unauthorised contributions to open-source software and publishing attacks on project volunteers. The problem is that the AI Act, drafted before the rise of agentic AI, may not adequately address these systems’ capabilities. Greens MEP Sergey Lagodinsky asked the Commission whether agents fall under existing rules; Commissioner Henna Virkkunen suggested they likely do. Nevertheless, some officials consider dedicated rules necessary. However, a November report stated that EU capitals argued against new rules, citing “regulatory fatigue” and suggesting “soft law” approaches based on UN frameworks instead.

Enforcement of the AI Act: Tristan Marcelin from the European Parliament Research Service has published an overview showing that the Act is enforced through a hybrid model shared between Member States and the European Commission. Specifically the risk-based approach enforces AI systems at the national level with centralised support, whereas general-purpose AI (GPAI) rules are exclusively supervised by the European Commission. However, the decentralised pattern remains dominant, potentially causing uneven enforcement across the EU. Under the AI Act, Member States must designate two authorities – a notifying authority and market surveillance authority – functioning as single national contact points. Although the deadline for designation was 2 August 2025, many Member States have faced delays. To support enforcement, the AI Act established EU-level entities: 1) the AI Office enforces GPAI provisions and develops soft instruments; 2) the European AI Board coordinates national authorities and disseminates expertise; 3) the Scientific Panel of independent experts centralises AI expertise advising the AI Office and national authorities; and 4) the AI Advisory Forum comprises industry, start-ups, SMEs, civil society and academic stakeholders, providing technical expertise and contributing to regulatory tasks.

Equinet-ENNHRI statement on the Digital Omnibus: Equinet and ENNHRI, representing independent European equality and human rights authorities, have issued a joint statement expressing concern that proposed amendments to the AI Act are proceeding without adequate impact assessments and public consultation, thereby risking fundamental rights protections. They emphasise the Commission’s obligations for transparent consultation and impact assessments under the EU Treaties and Better Regulation Guidelines. Critically, they note that the AI Act only entered into force on 1 August 2024, with most obligations applying from 2 August 2026, making meaningful impact assessment premature. Such changes could undermine ongoing implementation and legal certainty. They also caution that regulatory simplifications tied to company size rather than to the risk of AI systems could have systemic implications, given SMEs and Small Mid-Caps represent the overwhelming majority of European companies. Consequently, they recommend eight specific measures: 1) preserve AI registration requirements, 2) safeguard fundamental rights authorities’ powers, 3) maintain high-risk AI system timeline, 4) preserve strict necessity and fundamental rights standards, 5) prevent weakening of AI literacy responsibilities, 6) reject GDPR personal data definition weakening, 7) preserve key information obligations, and 8) reject automated decision-making amendment.

Open letter calling to reserve the horizontal approach: Multiple organisations, including TÜV-Verband, AlgorithmWatch and ForHumanity, are warning against Digital Omnibus proposals moving high-risk products to Annex I-B, which would abandon the AI Act’s horizontal regulatory approach. They contend that this would not simplify legislation but instead increase regulatory fragmentation, legal uncertainty and long-term compliance burdens. The reason: sector-specific legislation would require developing AI safety requirements across numerous directives without guaranteed timelines, creating diverging requirements and procedures. For companies, this means increased bureaucracy, higher compliance costs and reduced legal certainty. AI deployed in safety-critical areas, such as medical diagnostics, industrial machinery and automated decision-making, requires binding, clear and uniform standards. Currently, most EU product legislation lacks specific AI requirements and existing software provisions insufficiently address key AI risks. Moreover, uniform rules strengthen Europe’s global competitiveness and supply chain integration. By contrast, fragmented sector-specific rules would slow innovation, increase complexity and burden start-ups and SMEs.

Legislative Process

Commission publishes second draft of Code of Practice on marking and labelling of AI-generated content: The European Commission is facilitating a voluntary code of practice to help providers and deployers comply with Article 50 of the AI Act, which mandates marking and labelling of AI-generated content. This second draft incorporates feedback from hundreds of stakeholders, including industry, academia and civil society, gathered through surveys, meetings and workshops in January 2026, alongside contributions from Member States and European Parliament representatives. The revised code has been streamlined to reduce compliance burden whilst promoting open standards and an EU icon for labelling. The code comprises two sections: Section 1 addresses marking and detecting AI content for generative AI system providers, with enhanced flexibility and clarity; Section 2 targets deployers, focusing on labelling deepfakes and text on matters of public interest, adopting a more flexible and practice-oriented approach. Feedback on this draft is due by 30 March, with finalisation expected by early June 2026. The transparency rules become applicable on 2 August 2026.

Analyses

International AI Safety Report, key findings for the EU by lead writer Carina Prunkl: The 2026 International AI Safety Report was launched at the New Delhi AI Impact Summit. The Report was chaired by Yoshua Bengio and authored by 100+ independent experts, including an international panel with nominees from 30+ countries and international organisations. It provides a scientific assessment of general-purpose AI capabilities, risks and risk management. This makes the report highly relevant for EU institutions implementing the AI Act. It surveys a range of risks, including misuse (e.g. deepfakes, manipulation, cyberattacks, biosecurity), malfunctions (e.g. reliability failures and control challenges), and systemic risks (e.g. labour-market impacts and risks to human autonomy). The report points to rapid capability gains, especially in coding and science, alongside wide (if uneven) global deployment. It also notes rising deepfake-related incidents and that some developers added safeguards after concluding they could not confidently rule out assistance to novices in biological weapons development. At the same time, the report highlights growing challenges for reliable pre-deployment safety testing, in part because AI models now more frequently detect when they are being evaluated and exploit loopholes in tests. Together, these trends sharpen the report’s “evidence dilemma”: capabilities are advancing faster than the evidence base needed for effective governance.

Four Swedish founders comment on Sweden's AI strategy: Four Swedish founders Joel Hellermark, Johannes Schildt, Anton Osika and Fredrik Hjelm argued in an op-ed in Sifted that the strategic direction of the national AI strategy of Sweden is right: rather than competing with the US and China on foundation models, Europe should excel at applying them. However, they contend that ambitious government AI strategies across Europe frequently fail to produce tangible change. Sweden experiences brain drain as talented individuals relocate to San Francisco for higher returns and greater talent density, despite Sweden producing more tech unicorns per capita than most countries. They propose the following targeted reforms: an AI visa with two-week processing, competitive tax incentives for foreign talent, and streamlined bureaucratic procedures for international hires seeking housing and childcare. They also highlight fragmentation across Sweden’s 340 government agencies, 21 regions and 290 municipalities as obstacles during technological transitions. The AI Act creates a shared regulatory floor but does nothing to speed up implementation at the national level.

The case for a European Union digital enforcement authority: Mario Mariniello, Bruegel's Non-resident Fellow, wrote a policy brief arguing that the European Commission enforces the EU’s digital regulations but faces pressure to relax enforcement to avoid US retaliation. This creates risk of enforcement bias, which means either weakening oversight or unfairly penalising foreign competitors under the belief that this reduces EU technological dependence. Such bias undermines regulatory effectiveness and market competition. The policy brief examines whether delegating digital enforcement powers to an independent agency would improve outcomes. Independent EU agencies with significant enforcement and sanction powers already exist as precedent. The brief assesses whether increased enforcement accuracy justifies outsourcing enforcement and evaluates technical, political and legal feasibility. It concludes that structural separation of enforcement is unsuitable for the Digital Markets Act and Artificial Intelligence Act currently, but advisable for the Digital Services Act. Consequently, it recommends establishing an independent EU agency specifically to enforce the Digital Services Act, outlining its potential structure.

Recommendations on the Parliament amendments in the Digital Omnibus: Marcel Mir Teijeiro and Koen Holtman from The AI Standards Lab identified key concerns among the 750+ proposed amendments by the European Parliament. They oppose amendments excluding general-purpose AI model providers with systemic risk from responsibilities and oversight, which undermines the dual-use technology principle and creates loopholes. They also oppose amendments excluding certain high-risk AI systems from the Act’s scope, particularly those exempting business-to-business and internal AI uses, risking legal uncertainty and loopholes. They support preserving registration obligations in Article 6(4) and amendments aligning high-risk AI systems’ entry-into-force dates with Commission proposals. They oppose centralisation amendments concentrating oversight exclusively in the AI Office, citing capacity concerns, though recommending added Commission duties for adequate resourcing if pursued. Finally, they oppose proposed amendments on standards requests and common specifications, preferring existing versions.

Simplification for industrial AI rules? According to Maximilian Henning from Euractiv, ten EU countries, including Germany, France, Italy, Spain and Poland, called for clarification of how the AI Act interacts with a separate law on machinery and for realistic implementing deadlines for industrial AI. The Act, however, already specifies this interaction and carving out certain industrial AI uses. In the European Parliament, Centre groups made explicit simplification demands, building on the Commission proposal moving AI used in medical devices to a lighter regime. The European People’s Party seeks the same for all industrial sectors including machinery. The liberal Renew group, led by Svenja Hahn, proposes exempting industrial and business-to-business AI entirely. European Conservatives and Reformers push cutting rules for non-safety-related industrial AI systems. Together, these three groups nearly constitute a parliamentary majority. No substantial industrial AI changes appear in current Council draft compromise texts.

Legislative Process

Council spells out possible new powers for AI Office: A second Council compromise text for the AI simplification package details enhanced inspection powers for the AI Office under the AI Act, according to Maximilian Henning from Euractiv. The Commission’s November omnibus proposal sought to centralise AI market inspection powers within the AI Office, moving them away from national bodies. The Office would oversee AI systems built by companies on top of their own general-purpose AI models. Member states are now specifying that this should also apply within the same “undertaking” – a broad term covering organisations acting economically together – potentially encompassing corporate structures like Alphabet, Meta or xAI. The second draft clarifies enforcement powers, permitting the Office to examine company books and relevant data, take copies, and question staff about documents, though legally privileged information and journalists’ sources remain protected. The Office could also request national watchdogs investigate on its behalf.

Signatory Taskforce of the General-Purpose AI Code of Practice: The EU AI Office has launched The Signatory Taskforce, which facilitates exchanges and compliance, helping signatories implement EU rules for general-purpose AI models through the General-Purpose AI Code of Practice. The taskforce was established on 30 January 2026 to ensure coherent application and is chaired by the EU AI Office. The AI Act’s rules for GPAI model providers have applied since 2 August 2025, enhancing transparency, safety and accountability. Providers can demonstrate compliance through the code, prepared by independent experts via a multi-stakeholder process and endorsed by the Commission and AI Board. The taskforce enables members to exchange views on the code's implementation, provide input on guidance documents, discuss technological developments, and gather insights from stakeholders. It meets at least yearly, convened by the AI Office. The AI Office maintains transparency by publishing the taskforce Vademecum, including participants, and registering meetings with high-level summaries whilst respecting commercially confidential information.

Analyses

Digital omnibus on AI backgrounder: Niestadt Maria from the European Parliament Research Service published a briefing of the digital omnibus on AI. On 19 November 2025, the Commission published the Digital Omnibus on AI, proposing amendments to the AI Act and civil aviation regulation to address implementation issues and reduce regulatory burden. Implementation of the AI Act has faced delays regarding the designation of national competent authorities and the publication of harmonised standards. The Digital Omnibus forms part of a broader digital package including data and cybersecurity amendments, the European data union strategy, and European business wallets regulation, aiming to simplify and enhance EU digital laws and help businesses innovate whilst reducing costs. The Parliament has recognised the need for easier business compliance whilst emphasising that simplification must not compromise core policy objectives, digital rights or consumer protection. The European Council has also urged further simplification and improvement of EU laws to maintain the EU’s competitiveness. Stakeholder views diverge sharply. Industry groups welcome the proposals but ask them to go even further alongside the postponement of AI Act provisions. Civil society organisations warn against rolling back fundamental rights. Significant time pressure exists as the Omnibus seeks to amend application dates, including high-risk AI rules applying from 2 August 2026.

Reject the call to delete transparency safeguard: In a letter led by Access Now, the undersigned organisations and individuals urge the strongest possible rejection of the proposed deletion of the Article 49(2) transparency safeguard for high-risk AI systems in the AI Omnibus. This safeguard ensures that providers cannot circumvent core AI Act obligations. Removing it will create complication rather than simplification, drastically undermine enforceability, harm the functioning of the Single Market, and create unacceptable risks for health, safety and fundamental rights. Removing transparency would have three key negative consequences: 1) market surveillance authorities would lack oversight of exemptions and cross-member-state discrepancies; 2) providers gain opaque, unaccountable opt-outs, creating perverse incentives that disadvantage responsible providers in the market; and 3) the public, including civil society, would be unable to identify which providers have exempted themselves despite falling under high-risk categories, undermining transparency, public trust, and the ability to challenge exemptions.

AI Act delay is not enough: DIGITALEUROPE urges the European Parliament and Council not to sacrifice structural reform in the rush to adopt the AI omnibus, warning that Europe risks locking unresolved flaws into its most important digital law for years. European machinery manufacturers, medical technology firms and industrial software developers already struggle with high-risk classifications and overlapping conformity requirements. A delay to the AI Act high-risk obligations is urgent: standards are not ready, enforcement structures remain incomplete, and businesses cannot comply without missing pieces. However, using urgency to force through a lightly amended text would be a historic mistake. Cecilia Bonefeld-Dahl, DIGITALEUROPE Director General, stated that Europe needs a serious political conversation about whether the AI Act will strengthen or constrain the economy, impossible if lawmakers must rush the omnibus through. Rushing may secure delay but freeze unresolved problems for years at a decisive moment for competitiveness.

AI omnibus recommendations: Catelijne Muller, Alice Teilhard De Chardin and Lucrezia Geraldi from ALLAI argue that the AI Omnibus introduces significant structural changes amounting to deregulation and weakening of the AI Act’s protective goals, arriving when much of the Act has not yet entered into force. Key concerns include the following: 1) simplification contradicts the principle that clear and enforceable rules enable innovation; 2) linking obligations to standards risks discouraging proactive compliance and delaying safety-by-design; and 3) extending SME-style privileges to Small Mid-Caps applies lighter obligations to nearly 99% of EU companies, tying compliance to size rather than risk – flawed because high-risk AI harms citizens equally regardless of provider. Some further issues include downgrading AI literacy from binding requirement to policy objective creates accountability gaps; framing bias mitigation as a privacy trade-off presents a false dichotomy; removing fundamental rights authorities’ direct documentation access threatens their independence; and eliminating registration for self-assessed non-high-risk systems weakens scrutiny of potential misclassification.

Legislative Process

Commission misses high-risk AI guidelines deadline: Euractiv's Maximilian Henning reported that the European Commission will publish draft guidelines later this month to help developers identify high-risk AI systems under the EU AI rules, having missed the 2 February 2026 deadline. Classifying AI systems is essential for companies, as high-risk AI systems face significantly stricter requirements, including additional compliance documentation. The Act relies on the Commission guidance on classification, with a comprehensive list of practical examples. The Commission gathered input last summer and received feedback via the AI Board, a group of national experts. A Commission spokesperson explained that the delay resulted from integrating substantial feedback received over the past month whilst following internal procedures, adding that the priority remains publishing draft guidelines for final stakeholder consultation in February before official adoption. Renew lawmaker Michael McNamara, co-chair of a parliamentary group overseeing the enforcement of AI rules, called the delay “entirely unacceptable”, stating that it undermines the AI Office’s credibility. However, he emphasised that adequately staffing the Office to fulfil its responsibilities was of “utmost importance”.

Analyses

One EU AI law better than a hundred American ones: Mathieu Pollet and Pieter Haeck of POLITICO reported that the EU tech chief Henna Virkkunen defended Europe’s AI rulebook at Davos, suggesting that the US patchwork of state laws is no better for innovation. Speaking at the World Economic Forum, she noted that the European Commission adopted the AI Act early to prevent fragmentation through unified regulation. Responding to questions about US governance, Virkkunen countered that the USA possesses substantial AI regulation, citing Stanford University research showing over 200 state-level AI regulations. Virkkunen emphasised that Europe’s past overreliance on directives, permitting countries leeway to adapt EU legislation as they see fit, created numerous divergent rules, hindering scaling and single market access for European business. She stressed that regulations are preferable to directives in the digital field. While the Act functions as a bloc-wide regulation, several provisions still undergo supervision by national authorities, risking fragmentation in enforcement.

Can Europe still win the other AI race? An article in The Economist discussed that European companies have historically adopted new technologies slowly, yet AI provides a big opportunity. Whilst Europe built only three cutting-edge AI models in 2024 compared with China’s 15 and America’s 40, and lacks homegrown hyperscalers, widespread productivity gains depend more on adoption than model development. Europeans individually rank among the most enthusiastic generative AI adopters at 32%, exceeding Americans at 28% and Chinese at 16%, according to research from Microsoft. A European Investment Bank survey found that approximately 37% of EU firms use generative AI, matching American firms at 36%, though significant variation exists: Finland leads at 66%, whilst Italy and Greece lag at 20% and 19% respectively. Potential impediment to fast adoption includes the EU AI Act. Although it sets a global benchmark for safety and data protection, according to critics it creates too much red tape.

Major AI firms slow to disclose training data under EU rules: Maximilian Henning of Euractiv wrote that several major AI companies that have recently released new models appear non-compliant with the AI Act transparency rules. The legislation requires foundation model developers, such as those behind OpenAI's ChatGPT and Google’s Gemini, to publicly disclose information about training data. These disclosures matter especially for artists, writers and copyright holders, enabling them to verify whether their work has been used to train models and supporting legal action against rights violations. The Commission has provided a template establishing a “common minimal baseline”. However, major AI developers are not rushing to make submissions, potentially requiring the Commission to step in once the compliance grace period ends at the end of summer 2026. Notably, the Commission will only formally supervise and enforce these training data disclosure rules from this August, extending the compliance grace period until summer, though companies may voluntarily comply earlier.

European AI FOMO: Felix Bieker, a Senior Researcher at ULD ( the data protection authority of Schleswig-Holstein), and Katherine Nolan, an Assistant Lecturer in law at Technological University Dublin, published an op-ed in Verfassungsblog stating that the European Commission’s approach to digital regulation has shifted dramatically over the last twelve months amid geopolitical uncertainty and EU competitiveness concerns, moving away from the “Brussels Effect” as a global rule-setter emphasising fundamental rights. AI has become central to this shift, with the Commission's strategy driven by “AI FOMO” (fear of missing out). According to Bieker and Nolan, since the Letta and Draghi reports, the Commission has experienced AI FOMO, applying simplistic regulation-versus-innovation logic which undermines individual protections. The Digital Omnibus proposals exemplify AI FOMO, risking fundamental rights standards and the coherence of digital acquis. The barely-adopted AI Act faces reopening with deregulatory amendments: various rules delayed pending Commission decisions, AI literacy requirements watered down, and existing high-risk models largely exempted. This can encourage developers to flood the EU market with problematic technologies before full AI Act implementation.

Slow down not to water it down but to ensure its proper enforcement: Patrick Grady, the EU Policy Manager at Chamber of Progress, wrote a blog post arguing that the AI Act, nearly double the GDPR’s length with more articles, recitals and 13 annexes, requires substantial guidance for compliance, particularly for smaller businesses navigating its strictest rules. Grady states that the authorities in charge of creating technical standards are two years behind schedule. The Commission proposed a confusing 15-month enforcement pause until December 2027. However amendments allowing this pause could pass months after the rules take effect in August 2026 and the Commission retains the power to end the pause at any time. Grady argues that rather than watering down the AI Act, Europe should establish a clear compliance timeline, providing necessary breathing room to ensure proper implementation.

Legislative Process

Grok nudification scandal: POLITICO's Pieter Haeck reported that fifty-seven European Parliament lawmakers across the political spectrum have called for a ban on AI applications that generate non-consensual sexualised deepfake images within the EU. The call follows widespread outrage at proliferation of such images created by Grok bot on Elon Musk’s social network X. The lawmakers contend that these AI systems should be prohibited under the EU’s AI law, citing their facilitation of sexual violence against women and children. The European Commission has requested additional information from X and ordered retention of Grok-related documents until the end of the year. Although X announced it would prevent editing of images of people in revealing clothing, POLITICO verified that users could still generate such images. Lawmakers argue that the Digital Services Act alone is insufficient to address this problem, requesting the Commission to confirm that these systems are banned under the AI Act or other EU legislation. Relatedly, Laura Caroli, a former co-negotiator of the AI Act, has written a Substack post exploring how an AI Act ban on Grok’s nudification tool would work.

European Parliament digital omnibus leadership: According to Claudie Moreau and Maximilian Henning from Euractiv, Parliament’s civil liberties committee (LIBE) decided which political groups will lead two digital simplification packages: the Socialists and Democrats (S&D) will lead on data, whilst Renew secured AI. Renew’s Michael McNamara will lead the AI package and co-chairs Parliament’s working group monitoring Commission's implementation of the AI Act. McNamara emphasised that ensuring amendments genuinely simplify implementation without weakening core safeguards, stating that whilst speed matters given August 2026 high-risk AI compliance deadlines, urgency cannot replace evidence, transparency or accountability. Rapporteurs face significant pressure to conclude talks promptly as deadlines for high-risk AI rule compliance approach. The Council is also prioritising this file. S&D has not yet decided its rapporteur in relation to the data proposal; the European People’s Party similarly remains undecided, whilst Markéta Gregorová was expected to represent the Greens. The Patriots had also not decided.

AI guidelines to step in if standards miss 2027 deadline: The European Commission is preparing guidelines as a contingency measure to address potential delays in AI Act technical standards, according to documents seen by Euractiv. The standards, developed by European standardisation bodies CEN-CENELEC, are expected to detail compliance requirements for high-risk AI systems. However, numerous delivery delays have prompted concerns, with certain standards only anticipated in April 2027. These delays have prompted calls to freeze relevant AI Act rules, with governments arguing that companies require standards for compliance. The Commission responded in November by proposing to postpone high-risk AI rules to December 2027 or August 2028. The planned guidelines represent a transitional solution to forestall further delay requests should standards remain unavailable. These guidelines would differ from common specifications – an alternative backup option already foreseen in the AI Act, under which the Commission may independently adopt specifications if industry-written standards prove unavailable in time.

Proposal to simplify Medical Device Regulation: Elise Reuter, Senior Reporter at MedTech Dive, wrote that the European Commission has proposed revisions to medical and in-vitro diagnostic device regulations, praised by industry group MedTech Europe, aiming to simplify regulations by reducing administrative burdens, encouraging regulatory coordination and including provisions for rare disease treatments. The Commission anticipates annual cost savings of approximately 3.3 billion euros from the revision. The proposals address “unnecessary costs, bottlenecks, uncertainty for companies, and delays for patients.” Key changes include simpler rules for medical devices, expedited conformity assessment timelines and strengthened European Medicines Agency role in coordination across the EU. One proposal would limit the AI Act scope applying to medical devices with AI components currently potentially regulated as high-risk AI systems. The revisions would lower risk classifications for certain devices, including reusable surgical instruments and accessories for implantable devices. Laboratory-developed tests would be exempted from certain requirements if used exclusively for clinical trials. The Medical Device Regulation and In Vitro Diagnostic Regulation entered into effect in 2021 and 2022 respectively, with transition periods extended to 2027 or 2028 depending on a device’s risk class.

New boss at the EU AI Office safety unit: POLITICO Morning Tech reported that the European Commission has appointed Matthieu Delescluse as head of its AI Safety Unit, a position that remained vacant since the AI Office’s establishment last year and was temporarily filled by the AI Office boss Lucilla Sioli. According to a newly published organigram of DG Connect, the Commission’s technology department housing the AI Office, Delescluse is a DG Connect veteran with roles there since 2013. Whilst Delescluse lacks extensive AI background, his previous role involved work on the EU’s economic security strategy, specifically risk assessments conducted by the Commission’s executive on four critical technologies: semiconductors, quantum computing, biotechnology, and artificial intelligence.

Analyses

EU regulations are not ready for multi-agent AI incidents: Natàlia Fernández Ashman, Usman Anwar and Marta Bieńkiewicz published an op-ed in Tech Policy Press. The European Commission’s Article 73 guidelines for the AI Act, coming into force in August, mandate deployers and providers to report serious incidents involving high-risk AI systems such as critical infrastructure. However, the authors believe that the draft guidelines contain a significant loophole that urgently needs correction. The guidelines focus on single-agent, single-occurrence failures with simplistic one-to-one causality, yet serious risks increasingly emerge from AI system interactions producing cascading, cumulative effects. Current Article 73 wording assumes that only one system contributes to high-risk incidents, yet deployed AI systems increasingly interact with other agents and users, creating complex dependencies where assigning single culpability becomes obsolete. Examples such as algorithmic collusion in Germany’s fuel market and the 2010 Flash Crash demonstrate how AI incidents arise from multi-system interactions rather than isolated failures, with automated systems amplifying each other’s effects and triggering cascading network failures. The guidelines must explicitly recognise unexpected behaviour arising from system interactions. Additionally, draft guidelines lack structured third-party and whistleblower reporting pathways.

Legislative Process

First Code of Practice draft published: The first draft of the Code of Practice on transparency of AI-generated content addresses key considerations for providers and deployers of AI systems within the scope of Article 50(2) and (4) of the AI Act. Developed through collaborative effort involving hundreds of participants from industry, academia, civil society and Member States, the Code emerged from two Working Groups established in November 2025. The drafting process incorporated 187 written submissions from a public consultation, three workshops and a review of expert studies. The Code aims to ensure that AI-generated and manipulated content are marked in machine-readable, detectable and interoperable formats, whilst enabling people to identify deepfakes and AI-generated text published regarding matters of public interest. This foundational draft invites stakeholder feedback by 23 January 2026 to inform the second version, which will facilitate transparency of AI-generated content within the EU.

Analyses

2026 to be the year the world comes together for AI safety? A Nature editorial predicts continued progress in artificial intelligence in 2026, driven by further model development and growing global AI legislation. According to Stanford University’s Artificial Intelligence Index Report 2025, at least 30 AI laws were enacted worldwide in 2023, rising to 40 in 2024. East Asia, the Pacific, Europe and US states have led regulatory efforts, with US states alone passing 82 AI-related bills in 2024. However, low and lower-middle-income countries remain largely inactive, whilst the US federal government is undermining state-level AI regulation. The editorial argues that all nations require AI laws regardless of their position as producers or consumers. It emphasises that it’s impossible to imagine the technologies used in energy, food production, pharmaceuticals or communications being outside the ambit of safety regulation, and therefore, AI should be subject to the same. Given AI’s transformative potential and uncertainties, nations should collaborate to develop policies that not only enable development, but also incorporate guardrails. Let 2026 be the year we reach consensus on this.

EU could get a ‘common icon’ for labelling AI deepfakes: Maximilian Henning from Euractiv reported that the Code will detail how companies should disclose that photorealistic AI-generated content, such as images or videos appearing to show real persons, is actually synthetic media. It will also establish conditions for marking other AI-created content. For deepfakes, drafters from industry, academia and civil society propose an “EU common icon” – a symbol enabling people to identify at a glance whether an image depicting an apparently real event or person has been created or edited using AI, whilst providing access to further information. The icon should include a two-letter acronym referring to artificial intelligence, typically “AI” in English, with language-specific adaptations. Companies signing the Code would commit to support the development of a common icon and using an interim acronym-only version until finalisation. Signatories training their AI models would also commit to enabling downstream users to create content identifiable as synthetic.

Europe braces itself for AI Act effects: William Denselow in CGTN reported that the European Union will implement the majority of its landmark AI Act rules in 2026, marking significant governance changes for AI. Following gradual entry into force in 2024, 2026 will see comprehensive enforcement at both EU and national levels, establishing a precedent for the rapidly evolving sector. The EU emphasises trustworthy AI development, positioning European AI as a quality seal that inspires greater public confidence than alternatives from other sources. However, critics contend the Act constrains innovation as Europe competes with China and the United States. While EU officials assert that additional time is necessary for member states and companies to adapt, experts highlight the critical importance of clarity regarding liability issues and rigorous enforcement mechanisms. Without proper enforcement, we may have wonderful legislation without any effects. European officials maintain that AI technology is essential for the bloc’s resilience, competitiveness and security, and as global competition for AI dominance continues, the EU seeks to establish the rules of the game.

A guide to Fundamental Rights Impact Assessments (FRIAs): The Danish Institute for Human Rights and the European Centre for Not-for-Profit Law have created a practical guide to help deployers of high-risk AI systems conduct FRIAs. This guide incorporates international standards like the UN Guiding Principles on Business and Human Rights, structured across five phases with a downloadable FRIA template. Under the AI Act, certain deployers of high-risk AI systems must conduct a FRIA to identify and address potential negative impacts on rights enshrined in the EU Charter for Fundamental Rights. Such deployers include public entities using AI, for example, in education, employment, access to essential services and law enforcement. Beyond rights protection, well-designed FRIAs support organisations in developing responsible AI governance frameworks, building stakeholder trust, and minimising reputational and litigation costs. For public authorities, FRIAs incentivise democratisation of AI adoption decisions in critical areas.

AI Act for the automotive sector: Nicola Smith, David Naylor and Bartolomé Martín from the law firm Squire Patton Boggs published a summary exploring the intersection of the AI Act with traditional conformity assessment obligations for physical products. The authors state that many AI systems in the automotive sector will likely be treated as “high-risk” under the legislation, creating many regulatory obligations for providers, deployers, importers and distributors. Given significant penalties for non-compliance, automotive companies using or planning to use AI systems must understand their obligations and ensure effective compliance. The requirements are implemented phased over two years. Provisions on AI literacy and prohibited AI practices have applied since February 2025. Key provisions regarding high-risk AI systems take effect on August 2026, though provisions relating to classification due to product coverage under certain EU harmonised legislation apply from August 2027. The AI Act has extraterritorial effect, applying to non-EU businesses selling AI systems on the EU market or whose outputs are intended for EU use.

Legislative Process

Consultation on AI regulatory sandboxes: The European Commission is seeking feedback on draft implementing act for establishing AI regulatory sandboxes under the AI Act, with consultation open from 2 December 2025 to 13 January 2026. The Act permits prospective providers to develop, train, validate and test innovative AI systems for limited periods under regulatory supervision within controlled frameworks established by competent authorities, including in real-world conditions where appropriate. These AI regulatory sandboxes aim to support the Act’s objectives of fostering AI innovation whilst ensuring compliance with the legislation. The Commission will adopt an implementing act to set out common rules for the establishment and operation of sandboxes as mandated by the AI Act. The draft implementing act is available for public consultation for five weeks, during which stakeholders can submit comments on the proposed framework.

Consultation on protocols for reserving rights from text and data mining: The European Commission has launched a stakeholder consultation from 1 December 2025 to 9 January 2026 on protocols for reserving rights from text and data mining under the AI Act and General-Purpose AI (GPAI) Code of Practice. This supports implementing the Act’s obligation for GPAI model providers to identify and comply with rightsholders’ reservation of rights. The Commission, supported by the EU Intellectual Property Office (EUIPO) and stakeholder groups, is facilitating identification of state-of-the-art, technically implementable opt-out protocols widely adopted across cultural and creative sectors. The consultation invites rightsholders, GPAI providers, civil society organisations, standardisation bodies and others to share views on technical feasibility and uptake of different text and data mining opt-out solutions identified in EUIPO’s generative AI copyright study. Following discussions, the Commission will publish a regularly reviewed list of agreed machine-readable opt-out solutions.

Analyses

New standards mapping website: The EU AI Act Harmonised Standards Mapping by Adam Leon Smith provides a summary of intended coverage by CEN-CENELEC standards currently under development. This information derives from draft standards circulated for public enquiry (or Draft International Standards) and information published by CEN-CENELEC. The mapping represents intended coverage as standards are being developed, with standards at varying development stages requiring users to check stage indicators for maturity levels. Final harmonised standards may differ from current drafts, and enquiry-stage drafts have not received approval from national bodies. Users are advised always to consult the official EU AI Act text, the Official Journal of the European Union (OJEU), and published harmonised standards for compliance purposes rather than relying solely on this mapping. The interactive mapping has been created to assist stakeholders in understanding the developing standards landscape supporting AI Act implementation.

Safety scorecard looks at general-purpose AI providers’ practices: As reported by Jackie Snow in Quartz, the Future of Life Institute’s winter 2025 AI Safety Index has given failing or near-failing grades to all leading AI companies for their plans to control superintelligent systems, despite their race to develop technology surpassing human intelligence. The assessment evaluated eight major AI companies across six dimensions, including risk assessment, current harms and existential safety, using an independent panel of leading experts for their third edition. While Anthropic, OpenAI and Google DeepMind achieved the highest scores with C+ to C grades overall, every company received D or F grades on existential safety measures – the ability to prevent loss of control over advanced AI systems. Companies acknowledge catastrophic risks could be as high as one in three, yet lack concrete plans to reduce them to acceptable levels. Five companies participated in the detailed survey for the first time, providing unprecedented transparency, but even top performers fall short of emerging regulatory standards like the EU AI Code of Practice and California’s SB 53.

Regulatory chaos due to the proposal to pause high-risk rules: Pieter Haeck from POLITICO reported that the European Commission has created a significant legal muddle after agreeing to pause part of its AI law following industry pressure. The Commission’s delay requires legislative amendment through the European Parliament and Council of the EU, but until this occurs, the original 2 August 2026 deadline remains in force. Many fear the legislative fix won’t navigate EU legal machinery in time, creating highly disruptive confusion. The Commission stated the delay could last up to 16 months but might shorten if technical standards develop faster than expected. This uncertainty leaves company executives unable to plan effectively, with some potentially proceeding with compliance as a precaution. The Commission proposed pausing rules until December 2027 at latest but retains discretion to activate them earlier if support tools are ready, meaning companies could face six-month compliance notices anytime between August 2026 and December 2027. Even some lawmakers acknowledge that this approach fails to provide businesses the legal certainty required for operations.

Germany and several other countries pushing for more under the simplification: Maximilian Henning at Euractiv reported that several EU countries are pushing for the Commission’s Digital Omnibus proposal to go much further, according to ministers’ remarks during a recent telecommunications council meeting. Germany’s digital minister Karsten Wildberger openly stated “we need much more ambition and courage from the Commission,” describing the proposals as “very much not far reaching enough.” Sweden’s Erik Slottner called the proposal a good start but said “we will have to do more in the future,” whilst Czechia’s AI envoy Jan Kavalirek described it as “a strong starting point, but not the end of our efforts.” Ministers praised the Commission’s planned Digital Fitness Check to assess EU tech rules, potentially leading to further simplification efforts. Estonia’s Liisa-Ly Pakosta insisted current data and rights protections must be maintained, with Lithuania warning against further GDPR cuts. The Netherlands’ Vincent Karremans criticised the Commission’s movable AI Act deadlines as overly complex, preferring “one clear, fixed application deadline.” These early remarks establish positions for formal Council discussions, with high pressure for quick agreement given August deadlines, while Parliament’s social democrats, liberals and Greens have already expressed major complaints about the simplification push.

Legislative Process

Commission launches Digital Omnibus proposal: The European Commission has proposed simplification measures within the Digital Omnibus to ensure effective AI Act implementation whilst supporting innovation. The package addresses artificial intelligence, cybersecurity and data regulations. One of the key provisions links rules for high-risk AI systems to the availability of necessary support tools such as standards, with implementation delayed up to 16 months until the Commission confirms that these resources are ready. This approach aims to provide companies with essential guidance before enforcement begins. Other proposed amendments include extending SME simplifications to small mid-cap companies, potentially saving €225 million annually through reduced technical documentation requirements. The package also broadens regulatory sandbox access for more innovators, establishing an EU-level sandbox by 2028 and expanding real-world testing opportunities, particularly in sectors like automotive. Additionally, the Commission proposes reinforcing the AI Office’s powers and centralising oversight of AI systems built on general-purpose models to reduce governance fragmentation.

Commission launches whistleblower tool: The European Commission has launched a whistleblower tool for the AI Act, providing a secure and confidential channel for reporting suspected breaches directly to the EU AI Office. The system allows whistleblowers to submit information in any EU official language whilst maintaining the highest levels of confidentiality through certified encryption mechanisms. The tool enables whistleblowers to report potential violations that could endanger fundamental rights, health or public trust without compromising their anonymity. Whistleblowers can receive updates and respond to additional questions from the AI Office through the secure system. This initiative supports the Act’s objectives of promoting AI innovation while addressing risks to health, safety and fundamental rights, as well as safeguarding democracy and the rule of law. By reporting information about violations, whistleblowers can contribute to the safe and transparent development of AI technologies.

Two workshops on classification of high-risk AI systems: The European Commission, in partnership with service provider PPMI (part of the Verian Group), is hosting two online workshops on 11-12 December 2025 to examine the classification of high-risk AI systems under the AI Act. These sessions will bring together experts, practitioners, policy and societal stakeholders to identify challenges related to the classification of AI systems as high-risk under the AI Act. The first workshop on 11 December (09:30-12:30 CET) will focus on high-risk AI systems in critical infrastructure, education, employment, and essential public and private services. The second workshop on 12 December (13:00-16:00 CET) will address classification of high-risk AI systems for biometrics, law enforcement, migration and justice. Both workshops aim to support the safe and responsible implementation of AI systems under the Act. Stakeholder input gathered from these discussions will inform upcoming Commission guidelines on classification of high-risk AI systems.

Analyses

Summary of the proposed Digital Omnibus on AI: Law firm Cooley has summarised the European Commission's proposed “Digital Omnibus on AI” (19 November 2025) to streamline EU AI Act implementation, ease compliance burdens and adjust compliance deadlines before full application on 2 August 2026. Key amendments include 1) extended timelines for high-risk AI requirements, delayed until harmonised standards are ready; 2) extended grace periods for legacy AI systems giving generative AI providers six months extra (until 2 February 2027) to meet transparency obligations like content watermarking; 3) broader application of the bias mitigation derogation allowing all AI providers and deployers to process sensitive data to reduce bias regardless of risk level; 4) deletion of registration requirements for non-high-risk AI systems under Annex III, 5) codes of practice lose hard-law pathway; 6) clarifications on conformity assessment procedures for embedded AI; 7) scrapped post-market monitoring templates; 8) new provisions introducing EU-level regulatory sandboxes; 9) extending SME reliefs to small mid-caps; and 10) granting the Commission’s AI Office exclusive supervisory authority over AI systems based on general-purpose AI models. The proposal now proceeds to the Council and Parliament, with trilogue negotiations expected and considerable time pressure to finalise changes before August 2026.

Some European startups welcome expected AI Act delay while others don't: Freya Pratty and Daphné Leprince-Ringuet from Sifted reported that some European startups have welcomed reports that the EU plans to delay AI Act enforcement, though some warn against appearing to capitulate to US pressure. The Commission is reportedly considering a one-year grace period for companies breaching rules for high-risk AI systems and delaying fines for transparency violations until August 2027. Alexandru Voica from AI startup Synthesia supports a targeted rethink over proceeding with current regulations, and Hugo Weber from Mirakl sees the delay as beneficial for preparation and responsible adoption. However, Feargus MacDaeid from Definely warns that the pause risks appearing as capitulation to external pressure, advocating for a strategic pause rather than a political concession. EU Startups Commissioner Ekaterina Zaharieva maintains that Europe is proceeding independently. Some industry voices, including France Digitale’s Marianne Tordeux-Bitker, express concern that delays create uncertainty after businesses have already integrated constraints for over a year.

How the AI Act was made and what the future holds: Barbara Moens and Melissa Heikkilä in the Financial Times wrote that nearly two years after European officials celebrated agreeing the world-first AI Act following 36 hours of exhausting negotiations in December 2023, Brussels is struggling with implementation complexities. The legislation was designed to establish trustworthy AI through risk-based regulation, but its complexity and rushed inclusion of AI models like ChatGPT have transformed it for some from a symbol of European leadership into a case study. The Commission has now proposed the postponement of key high-risk AI rules by at least one year, marking the first formal acknowledgement of implementation difficulties. This shift reflects changing priorities under von der Leyen’s second mandate, focusing on competitiveness amid global AI competition between the US and China. Proponents of the AI Act see the developments as a setback, arguing that this delay undermines Europe’s regulatory leadership, and dismiss criticism around the Act as industry “propaganda”. The delay remains controversial, requiring approval from Parliament and member states, as Europe grapples with balancing innovation and safety in AI governance.

Legislative Process

Code of practice on AI-generated content launches: The European Commission has initiated work on a code of practice for marking and labelling AI-generated content, launching with a plenary meeting on 5 November 2025. The initiative responds to increasing difficulties in distinguishing between AI-generated and human-created content, aiming to reduce risks of misinformation, fraud, impersonation, and consumer deception. This voluntary code will help providers meet AI Act transparency requirements, which mandate clear marking of deepfakes and certain AI-generated content. The code will support content marking in machine-readable formats to enable detection across various media types including audio, images, video and text. The code will particularly focus on helping deployers disclose AI involvement in public interest matters. Independent experts appointed by the European AI Office will lead a seven-month, stakeholder-driven process, incorporating input from public consultation and selected stakeholders. These requirements will take effect in August 2026, complementing existing regulations for high-risk and general-purpose AI. Meet the chairs of the new code here.

Social democrats lay down red lines on revamping EU’s digital rulebook: As reported by Euractiv's Claudie Moreau and Maximilian Henning, the European Parliament’s social democrats have publicly expressed concerns about the upcoming digital omnibus proposal through a letter to Tech Commissioner Henna Virkkunen. The group warns they will oppose changes that could compromise fundamental rights. The European Commission is set to present modifications to EU digital laws this week, with leaked drafts suggesting changes to privacy and artificial intelligence rules. The social democrats strongly oppose any delay to the rules for the AI Act’s high-risk systems, which has been advocated for by some member states and industry groups. Additionally, the MEPs have raised serious concerns about proposals that would exempt providers of non-high-risk AI systems from mandatory registration in an EU database before market placement.

Greens/EFA letter on the digital omnibus: The Greens/EFA group in the European Parliament has written to EU Commissioner Henna Virkkunen expressing strong opposition to leaked digital omnibus proposals that would modify the AI Act. They argue the proposed changes would fundamentally undermine the law by yielding to non-EU industry pressure to remove important transparency requirements, weakening accountability and enforcement, and getting rid of much needed rules for AI literacy. The group warns that weakening transparency rules on energy use and sustainability standards, along with changes to fundamental rights impact assessments, could harm EU citizens while offering minimal innovation benefits. The Greens/EFA particularly criticise considerations to “stop the clock” due to standards-development delays, arguing this would remove incentives for swift standard finalisation. They suggest these delays have been deliberately orchestrated by those seeking to prevent effective enforcement of the rules for high-risk AI systems.

Analyses

EU prepares to delay high-risk rules by one year: Pieter Haeck and Gabriel Gavin from POLITICO reported that the European Commission is expected to propose a one-year delay to a key element of its AI Act, rules governing high-risk AI systems, according to two Commission officials. The delay, pushing implementation to August 2027, will be presented as part of a digital simplification package on 19 November. This shift marks a significant change in the EU’s approach, moving from its position as a regulatory front-runner to prioritising competitiveness with the US and China. The decision follows pressure from the US administration, tech companies and lobby groups, along with some EU member states citing delays in technical standards development. The proposal, which requires approval from EU countries and the European Parliament, was presented to Commission cabinet specialists. While Commission spokesperson Thomas Regnier declined to comment on leaks, he acknowledged ongoing discussions about potential implementation delays.

What’s driving the EU's AI Act shake-up? Freelance journalist Raluca Besliu wrote in Tech Policy Press that the European Commission plans to announce AI Act amendments on 19 November as part of the Digital Omnibus package. While US tech giants, through organisations like the Computer and Communications Industry Association (CCIA), lobby for widespread simplification of EU digital regulations, the Commission publicly maintains its independence in legislative decisions. Some internal EU divisions are evident, with Denmark advocating comprehensive reform, Germany opposing fundamental changes, and the Netherlands seeking a middle ground. The European tech sector is also divided, with 56 EU-based AI companies requesting simplification, while others criticise the proposed reforms as insufficient. Key proposals include potentially delaying high-risk requirement enforcement due to standards development delays and expanding the AI Office’s oversight powers to include all AI systems based on general-purpose AI models. This would centralise more authority in Brussels. Civil society organisations meanwhile warn that “simplification” could become a euphemism for deregulation, potentially weakening digital protections.

Biological AI is slipping through Europe’s AI law: Melissa Hopkins, the Health Security Policy Advisor at the Johns Hopkins Center for Health Security, published an op-ed in Tech Policy Press arguing that a critical regulatory gap in the AI Act leaves dangerous biological AI models (BAIMs) unregulated, despite their capacity to pose serious biosecurity risks. While the Act’s obligations for general-purpose AI providers took effect in August 2025, recent EU AI Office guidance appears to exclude these models from oversight. Although regulators are rightly concerned about large language models like ChatGPT potentially facilitating biological attacks by sharing sensitive information, they’ve overlooked BAIMs that could enable more severe outcomes, such as enhancing pathogen transmissibility and lethality. Unlike restricted language models, BAIMs are often released as open-source, increasing their accessibility and potential dangers. The disconnect between the Act’s recognition of biological risks as systemic threats and its implementation guidance could lead BAIM developers to conclude they’re exempt from regulation. To address this security gap, the AI Office could issue clarifying guidance to explicitly include BAIMs within the Act’s scope, rather than relying on case-by-case assessments.

Jobs

The Future of Life Institute (me!) is hiring for an EU Policy Advocate/Lead in Brussels. This person will lead FLI's research and enforcement efforts related to general-purpose AI under EU laws. The application deadline is 30 November 2025. Compensation is from €75,000 to €135,000 per year.

Legislative Process

German digital ministry asks: According to Luca Bertuzzi from MLex, Germany’s digital ministry has proposed significant changes to the AI Act through a draft position paper circulated by the Federal Ministry for Digital Transformation, which requires Social Democratic Party approval to become official stance. The paper advocates for more lenient implementation and reduced requirements. It suggests one-year extensions for high-risk requirements and sectoral obligations deadlines, broader research exemptions encompassing real-world testing, and harmonisation of terminology across EU regulations. The ministry also seeks streamlined documentation requirements, clearer definitions of model providers and provider-user transitions, and a review of high-risk categories, particularly in insurance. Additional recommendations include simplifying technical documentation and AI literacy requirements, removing fundamental rights impact assessments for public bodies, and extending quality management system exemptions to SMEs and start-ups.

Dutch authority probe into early violations of the rules for general-purpose AI models: Luca Bertuzzi also reported that OpenAI, xAI and Mistral may face early enforcement actions under the AI Act following a Dutch Data Protection Authority investigation revealing their chatbots provided misleading voting advice ahead of parliamentary elections. The authority’s vice-chair, Monique Verdier, warned that this misguided advice threatens democratic integrity. While the Act’s general-purpose AI rules took effect on 2 August, they currently only apply to new models. Models released by these three companies after 2 August may face obligations if they meet the “systemic risk” threshold of 10²⁵ FLOPs computing power, though this information hasn’t been publicly disclosed. The Dutch authority has informally shared its findings with the EU AI Office. Developers could face private litigation, and chatbots influencing elections might be classified as “high-risk systems” under the Act, subjecting them to stricter regulations.

Standards bodies’ decision to accelerate the development of standards: CEN and CENELEC have announced exceptional measures to expedite the development of European standards supporting the AI Act, following decisions made at their joint Technical Boards meeting in October 2025. The accelerated process includes allowing direct publication of drafts following positive votes, bypassing separate formal votes, and establishing a small expert drafting group to finalise six delayed drafts. These measures aim to ensure standards availability by Q4 2026 while maintaining standardisation principles of inclusiveness, transparency and consensus. The new drafting group will facilitate technical consolidation while preserving the participatory nature of the process. The organisations emphasise these are temporary measures to meet urgent demands for AI standards supporting the AI Act’s implementation.

Analyses

Fast-tracking of standards-writing controversy: According to Euractiv's Maximilian Henning, leaders of EU AI standards drafting have protested against recent fast-tracking measures, warning of “serious unintended consequences” in a letter to EU authorities and standards bodies CEN-CENELEC. The unprecedented acceleration allows smaller expert groups to finalise delayed AI standards, particularly those concerning high-risk AI systems’ trustworthiness, datasets and biases. The streamlined process includes clear deadlines and fewer procedural steps. The drafters argue this undermines standardisation’s core principle of consensus and threaten to resign if the decision isn’t reversed. While CEN-CENELEC describes these measures as exceptional, unique and temporary, these assurances haven’t satisfied the protesters. The controversy relates to wider debates about potentially pausing the AI Act’s rules for high-risk systems. Proponents of the delay cite insufficient adjustment time for companies before the August 2026 implementation, given missing standards. Many countries supporting delays are themselves behind in establishing enforcement structures. The Commission is currently reviewing its standards-setting procedures.

Delaying AI Act enforcement for European SMEs: Sebastiano Toffaletti, DIGITAL SME Secretary General, wrote in an op-ed that with the AI Act’s enforcement for “high-risk” solutions beginning in ten months, essential implementation tools remain incomplete, particularly affecting SMEs’ ability to comply. While the Act’s aim to ensure trustworthy, human-centred technology is commendable, the current state of preparedness risks hampering European AI innovation. Of 45 required technical standards, only 15 have been published, with nearly half projected to remain incomplete by the August 2026 deadline. Regulatory sandboxes, meant to provide safe testing environments, are largely unavailable - only Spain has one ready, while ten member states haven’t proposed legislation for their creation. Additionally, only eight of 27 member states have designated required market surveillance authorities. This situation forces European SMEs to either risk costly compliance guesswork or delay innovation. Toffaletti advocates delaying enforcement for SMEs until at least six months after all standards, sandboxes and guidance are operational, arguing this would strengthen rather than weaken the Act’s effectiveness.

Europe’s advanced AI strategy depends on a scientific panel: Kai Zenner, the Head of Office and Digital Policy Adviser for MEP Axel Voss, published an op-ed in Tech Policy Press stating that the European Commission has concluded its call for experts to join the AI Scientific Panel, a 60-member body advising the European AI Office on implementing the AI Act from 2026. The panel will focus on general-purpose AI, providing guidance on systemic risks, model classification and emerging threats. While hundreds have applied, member states have imposed restrictive national quotas requiring at least one expert per country and 80% of members from EU/EFTA states. This requirement presents challenges, particularly for smaller nations, which could potentially compromise the panel’s expertise quality. Zenner argues for prioritising world-renowned AI researchers with proven track records in monitoring frontier developments over national quotas. Zenner emphasises the need for independent third-party evaluators and specialists rather than generalists, suggesting that industry connections shouldn’t automatically disqualify candidates if balanced with independent experts. Additionally, he advocates for including younger voices actively involved in frontier AI development rather than retired professionals.

Jobs

The Future of Life Institute (me!) is hiring for a UK Policy Advocate/Lead in London. While this role won’t directly focus on the EU AI Act, it will require advising the UK government on its forthcoming AI bill. This will involve understanding the bill’s focus in comparison to the EU’s work. The compensation for this role is £95,000-£160,000 per year, with an application deadline of 19 November 2025.