Updated weekly
A curated timeline of AI governance, privacy and security regulation that matters to teams shipping ML systems. We track the EU, the US at federal and state level, the UK, and global standards bodies.
One of the most comprehensive disclosure regimes for generative AI content in the US takes effect, requiring providers to disclose when content is AI-generated. Applies to providers serving California users regardless of where they are established.
Deployers must disclose when a person is interacting with an AI system and label AI-generated content. Unlike the high-risk obligations, this date was not deferred by the Digital Omnibus and is now subject to enforcement.
The one-year grace period following the August 2025 GPAI obligations ends. The AI Office may now issue requests for information, require model access, and pursue model recalls against GPAI providers.
Published in the Official Journal on 24 July. High-risk obligations under Annex III move from 2 August 2026 to 2 December 2027, a 16-month deferral; Annex I product-embedded systems move to 2 August 2028. Watermarking moves to 2 December 2026. This is now binding law, not a proposal.
Supports the quality management system that Article 17 requires of high-risk AI providers. Alongside the European adoption of EN ISO/IEC 42001:2026, this gives providers a harmonised route to demonstrating conformity.
Completes the legislative passage of the deferral, following the European Parliament’s endorsement of the provisional agreement on 16 June. Sets up publication and entry into force the following month.
Draft guidance on how to classify an AI system as high-risk under the Act. Relevant to anyone relying on the Annex III carve-outs, since classification determines which obligations attach and by when.
SB 26-189 repeals the Colorado AI Act before it ever took effect. The impact assessments, mandatory risk management programme and the NIST/ISO affirmative defence are gone. The replacement centres on pre-use consumer notices, 30-day adverse-outcome explanations, meaningful human review and developer documentation, with a 60-day cure period and exclusive attorney-general enforcement.
The US District Court for the District of Colorado granted a joint motion to stay enforcement, after the original February 2026 date had already been pushed to 30 June. Superseded three weeks later by the repeal.
Sets the direction for a Trustworthy AI in Critical Infrastructure profile, guiding operators on risk management practices when adopting AI-enabled capabilities. Part of a wider shift from foundational guidance to sector-specific, implementation-ready material.
Draft guidance on how providers should mark and label AI-generated content, which underpins the Article 50 transparency obligations that became enforceable in August.
Run through the Center for AI Standards and Innovation, aiming at voluntary guidelines for AI agents covering identity and authorisation, security and risk management, and monitoring and logging. An AI Agent Interoperability Profile is expected in Q4 2026.