EU AI Act News & Updates

The signed act confirms the deferral of Annex III high-risk obligations to 2 December 2027 and Annex I obligations to 2 August 2028, while keeping Article 50 transparency obligations on the original 2 August 2026 date.

Publication in the Official Journal is expected within days, with entry into force on the twentieth day after publication - in time for the 2 August 2026 milestone.

Organisations should now treat the new timeline as the definitive planning baseline and update internal roadmaps accordingly.

Council adoption confirms the deferred high-risk timeline (2 December 2027 for Annex III, 2 August 2028 for Annex I) and the new Article 5 prohibition on AI-generated non-consensual intimate imagery and CSAM effective 2 December 2026.

With Council adoption complete, the file moves to signature by the Presidents of Parliament and Council, followed by publication in the Official Journal of the EU.

The confirmed text keeps Article 50 transparency obligations on the original 2 August 2026 date - chatbots, deepfake labelling, emotion-recognition notices and watermarking of AI-generated output all apply on schedule.

Article 4 on AI literacy is softened from a level guarantee to a duty to 'support the development of' literacy, and a new Article 5 prohibition on AI-generated non-consensual intimate imagery and CSAM enters into force on 2 December 2026.

The package takes effect once formally adopted and published in the Official Journal of the EU, expected before 2 August 2026.

The provisional deal defers Annex III high-risk obligations by 16 months to 2 December 2027 and Annex I obligations to 2 August 2028.

It also adds a new Article 5 ban on AI-generated non-consensual intimate imagery and CSAM effective 2 December 2026, and softens the Article 4 AI literacy duty.

Trilogue closed after just three rounds, faster than most observers expected. Formal Parliament and Council adoption follow in June 2026.

GPAI provider obligations have applied since 2 August 2025. The updated Code translates the legal text into practical templates for model documentation, training-data summaries and downstream deployer instructions.

GPAI models with systemic risk (compute >10^25 FLOPs) get a dedicated chapter covering model evaluations, adversarial testing, cybersecurity protection and serious-incident reporting.

Signing the Code creates a presumption of conformity for the covered obligations, but the underlying legal duties remain the same for non-signatories.

The toolkit covers all four Article 50 duties: chatbot disclosure (Art. 50(1)), emotion recognition and biometric categorisation notices (Art. 50(3)), deepfake labelling (Art. 50(4)) and watermarking of AI-generated output (Art. 50(2)).

The watermarking specification follows the C2PA content credentials standard for images and video, and a Commission-recommended header format for AI-generated text.

Deployers relying on the toolkit's default wording are presumed to satisfy the Article 50 information-provision duties.

Germany designated the BNetzA as lead market surveillance authority alongside the BfDI for high-risk systems processing personal data.

France concentrated market surveillance at the DGCCRF with the CNIL retaining biometrics oversight; Spain chose its purpose-built AESIA agency.

The AI Office is now publishing the consolidated list on its website so providers know which authority to notify serious incidents to.

The Dutch, French and Italian authorities coordinated the action, targeting SaaS vendors that offered emotion inference on video-call platforms without qualifying medical or safety justifications.

No fines were issued in this first round - the authorities framed the action as a compliance nudge - but the joint statement made clear that repeat violations from mid-2026 will trigger the Article 99 fining regime.

The case is a preview of how coordinated enforcement is likely to look once Annex III obligations bite from 2 December 2027.