European Union

12 July 2024Human Rights & EthicsLiability & AccountabilityCybersecurity+3

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2022/2557

The EU AI Act is the world's first comprehensive legal framework for artificial intelligence, establishing a risk-based classification system (unacceptable, high, limited, and minimal risk) for AI systems placed on the EU market. It imposes obligations on providers and deployers proportionate to risk level, with the strictest requirements — including conformity assessments and human oversight — applied to high-risk systems such as those used in critical infrastructure, employment, education, and law enforcement. The regulation entered into force on 1 August 2024, with provisions applying in phased stages through to August 2027.

28 September 2022Liability & AccountabilityHuman Rights & Ethics

Working Paper✓ Official

Proposal for a Directive of the European Parliament and of the Council on adapting non-contractual civil liability rules to artificial intelligence (AI Liability Directive)

This proposed directive aims to make it easier for individuals harmed by AI systems to seek compensation by addressing the evidential difficulties specific to AI-related damage. It introduces a rebuttable presumption of causal link between an AI provider's fault and harm caused, and requires providers of high-risk AI systems to disclose relevant evidence when damage is suspected. The proposal complements the EU AI Act and the revised Product Liability Directive, forming part of the EU's broader AI liability framework. Note: as of mid-2024, the proposal was stalled in trilogue negotiations.

04 May 2016Data Privacy & ProtectionHuman Rights & EthicsGenerative AI

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

The GDPR is the EU's foundational data protection law and is directly applicable to AI systems that process personal data of EU residents, governing lawfulness of processing, data minimisation, purpose limitation, automated decision-making rights (Article 22), and data subject rights including the right to explanation. The European Data Protection Board has issued guidance confirming that AI systems — including large language models — processing personal data must comply with GDPR, and several national supervisory authorities have issued enforcement actions against AI tools on GDPR grounds. It remains the primary EU legal instrument constraining AI data practices pending full application of the AI Act.

National Strategy✓ Official

Communication from the Commission — Artificial Intelligence for Europe (COM/2018/237)

This communication launched the EU's first comprehensive AI strategy, setting out a three-pronged approach to boost the EU's technological and industrial capacity in AI, prepare for socio-economic changes, and ensure an appropriate ethical and legal framework. It called for increased investment, better data access, talent development, and international cooperation, and initiated the process that led to the High-Level Expert Group on AI and the Ethics Guidelines. It established the foundational framing of AI as a strategic priority for Europe's digital economy and society.

25 April 2018National StrategyLabor & WorkforceHuman Rights & Ethics

19 February 2020National StrategyHuman Rights & EthicsLiability & Accountability

Communication from the Commission — White Paper on Artificial Intelligence: A European approach to excellence and trust (COM/2020/65)

This white paper set out the Commission's vision for a regulatory framework for trustworthy AI, introducing the concept of a risk-based approach and outlining the policy options that would ultimately shape the EU AI Act. It distinguished between high-risk and lower-risk AI applications and proposed requirements around training data, transparency, human oversight, robustness, and accuracy. It was accompanied by a European strategy for data and was open for public consultation, directly informing the 2021 AI Act legislative proposal.

National Strategy✓ Official

Communication from the Commission — Fostering a European Approach to Artificial Intelligence (COM/2021/205) and revised Coordinated Plan on Artificial Intelligence 2021

This communication updated the EU's coordinated plan on AI, aligning it with the European Green Deal, industrial strategy, and digital strategy, and setting out four key objectives: ensuring the EU is the right place to develop and deploy trustworthy AI, making the EU the best place for AI innovation, building the AI ecosystem of excellence, and ensuring AI works for people. It was released on the same day as the proposed AI Act and the updated coordinated plan, together forming the EU's integrated AI policy package for 2021. The coordinated plan called on Member States to update their national AI strategies accordingly.

21 April 2021National StrategyHuman Rights & EthicsLabor & Workforce

24 January 2024National StrategyGenerative AILiability & Accountability

Commission Decision of 24 January 2024 establishing the European Artificial Intelligence Office

This Commission Decision formally established the European AI Office within the Directorate-General for Communications Networks, Content and Technology (DG CONNECT), as the body responsible for overseeing and enforcing the AI Act at EU level, particularly for general-purpose AI (GPAI) models. The AI Office is charged with developing technical standards, conducting evaluations of GPAI models, coordinating enforcement across Member States, and advancing international engagement on AI governance. It became operational in February 2024 and represents the EU's central institutional hub for AI regulation.

21 April 2021National StrategyHuman Rights & EthicsLiability & Accountability

Working Paper✓ Official

Proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) — COM/2021/206

This is the original Commission legislative proposal for the EU AI Act, which initiated the three-year legislative process culminating in Regulation 2024/1689. It introduced the risk-based framework, defined AI systems, established prohibited AI practices, and set out requirements for high-risk AI systems across multiple sectors. The proposal underwent significant amendment during European Parliament and Council negotiations, particularly regarding general-purpose AI and foundation models, before final adoption in 2024.

12 July 2023CybersecurityLiability & AccountabilityHuman Rights & Ethics

Regulation (EU) 2023/1230 of the European Parliament and of the Council on machinery (recast) — AI-relevant provisions

The recast Machinery Regulation updates the legal framework for machinery safety and is directly relevant to AI because it covers machinery incorporating AI components and autonomous systems, requiring them to meet safety and cybersecurity requirements. It introduces explicit provisions for self-evolving and self-learning machinery, requiring that such systems remain safe throughout their operational life. This regulation interacts with the EU AI Act for machinery classified as high-risk AI systems.

18 June 2024Generative AICybersecurityLiability & Accountability

Guidelines for providers of general-purpose AI models — European AI Office (First Draft)

Published by the European AI Office ahead of the GPAI provisions of the AI Act taking effect, these draft guidelines set out practical obligations for providers of general-purpose AI models including GPT-class systems and open-weight models, covering transparency, copyright compliance, systemic risk assessment, and incident reporting. They distinguish between standard GPAI models and those posing systemic risk (above a defined training compute threshold), with the latter subject to more stringent requirements including red-teaming and adversarial testing. The guidelines were subject to public consultation and further refinement through 2024–2025.

26 March 2026Online Safety & Child ProtectionHuman Rights & EthicsPublic Sector & Governance

EU Parliament agree on proposals to simplify AI Act and propose clear application dates for high-risk system requirements and a ban on AI “nudifier” systems

The European Parliament has adopted its position on a simplification proposal amending the EU AI Act with 569 votes in favor, 45 against, and 23 abstentions, which delays the application of certain rules on high-risk AI systems to ensure readiness of guidance and standards for companies. MEPs propose fixed application dates of 2 December 2027, for specific high-risk AI systems, 2 August 2028 for those covered by EU sectoral legislation, and 2 November 2026 for compliance with watermarking rules for AI-generated content. Additionally, MEPs seek to introduce a ban on "nudifier" systems that create explicit images of identifiable individuals without consent, while allowing exceptions for systems with effective safety measures. They support measures to enable service providers to process personal data to detect biases in AI systems with necessary safeguards, extend support measures to small mid-cap enterprises, and argue for less stringent obligations under the AI Act for products already regulated by sector-specific EU laws. Negotiations with the EU Council on the final form of the law can now begin.

19 March 2026Liability & AccountabilityHuman Rights & EthicsOmnibus

MEPs support postponement of certain rules under the AI Act

The Internal Market and Civil Liberties committees have adopted their joint position on a simplification proposal amending the EU AI Act, with 101 votes in favor, 9 against, and 8 abstentions, suggesting the postponement of certain rules for high-risk AI systems until 2 December 2027 for specific applications and until 2 August 2028 for those under EU sectorial legislation, while supporting extended compliance deadlines for watermarking AI-generated content to 2 November 2026, allowing service providers to process personal data to detect biases in AI systems with necessary safeguards, extending support measures to small mid-cap enterprises, and advocating for less stringent obligations under the AI Act for products already regulated by sector-specific laws, with negotiations with the Council expected to commence following the anticipated approval of Parliament’s mandate on 26 March 2026.

17 March 2026Public Sector & Governance

European Data Protection Supervisor adopts strategy for supervising systems under EU AI Act

The European Data Protection Supervisor (EDPS) has adopted a compass outlining how it will implement its new mandate under the EU AI Act as both market surveillance authority and notified body for AI systems used by EU institutions, bodies, offices and agencies. It applies to AI systems deployed within the EU public administration, particularly high-risk systems, including biometric and recruitment tools. It establishes a two-tier supervisory framework, combining ex ante conformity assessments for certain high-risk systems and ex post market surveillance and enforcement, alongside four strategic pillars covering supervision, regulatory coordination, institutional capacity-building, and international cooperation. It was stated that the EDPS will introduce enforcement procedures, audits, sandbox testing, and knowledge-sharing mechanisms while strengthening technical expertise and ensuring independence between its roles.

13 March 2026Human Rights & EthicsPublic Sector & Governance

European Council agrees position to streamline rules on AI

The European Council has agreed on a proposal to streamline AI Act rules as part of the “Omnibus VII” legislative package aimed at simplifying the EU's digital legislative framework and harmonizing AI regulations. Marilena Raouna, Deputy Minister for European Affairs of Cyprus, emphasized the urgency of this proposal to enhance the EU's digital sovereignty, providing greater legal certainty and proportionality while ensuring consistent implementation across member states. Key amendments include a prohibition on generating non-consensual sexual content, a fixed timeline for applying high-risk AI rules, and obligations for AI system registration in the EU database. The proposal also postpones the establishment of AI regulatory sandboxes until December 2027 and clarifies the AI Office's supervisory powers. Following the Council's approval, negotiations with the European Parliament will commence, aligning with the European Council's call for a simplified regulatory framework to boost competitiveness and reduce burdens on businesses, particularly SMEs.

12 March 2026Liability & AccountabilityAi Safety

European Commission opens consultation on draft implementing regulation on conduct of certain proceedings pursuant to EU AI Act

The European Commission has opened a consultation on the draft Implementing Regulation regarding the conduct of proceedings under the EU AI Act. The draft: (1) requires AI providers to provide timely access to necessary elements such as APIs, source code, and infrastructure when requested by the Commission, and may mandate the disabling of logging measures that could track this access; (2) establishes that access levels must be equivalent to those available to the provider's employees and outlines procedures for initiating and concluding proceedings against general-purpose AI model providers, including interim measures for urgent health or safety risks; (3) includes procedural safeguards for addressees, rules for protecting business secrets, and specifies a five-year limitation period for imposing fines; (4) mandates digital communication requirements, including qualified electronic signatures; and (5) sets criteria for the independence of experts involved in evaluations, ensuring they have no conflicts of interest. The consultation will close on 9 April 2026.

11 March 2026Human Rights & Ethics

Other

Safety bodies, experts warn against softening EU AI Act's overlap with sectoral rules

It is reported that a coalition of AI safety organizations and experts, including participants in the AI Act's standardization process, have expressed concern over a European Parliament proposal within the AI omnibus amendment package that aims to relax the AI Act's requirements for products already governed by sector-specific safety regulations. They argue that such a softening could undermine the effectiveness of the AI Act and compromise safety standards.

11 March 2026DeepfakesOnline Safety & Child Protection

Other

EU set to ban AI nudification apps in wake of Grok scandal

It is reported that the European Union is considering banning AI-powered 'nudification' tools, such as X's Grok, which have been used to generate non-consensual explicit images of women and minors. This move follows a global backlash against Grok's 'spicy mode' that allowed users to create sexualized deepfakes. A proposal set to be approved by EU ambassadors on Friday would make it illegal to market in EU any AI system that can generate non-consensual sexualized videos, images or audio files involving real people. For background, the European Commission has been investigating X (formerly Twitter) and Grok for potential violations of the Digital Services Act and is contemplating classifying such AI-generated sexual images as unacceptable risks under the AI Act. Additionally, over 100 organizations, including Amnesty International and Interpol, have called for urgent action against these tools, highlighting their significant threat to child safety and human dignity.

5 March 2026Generative AI

European Commission opens consultation on second draft Code of Practice on marking and labelling of AI-generated content

The European Commission has opened a consultation on the second draft Code of Practice on Transparency of AI-Generated Content. The Code of Practice addresses obligations under Article 50 of the AI Act for providers and deployers of AI systems generating content. It comprises two sections, one covering rules for marking and detection of AI-generated and manipulated content applicable to providers of generative AI systems under Article 50(2) and (5) AI Act, and another covering rules for labelling of deepfakes and AI-generated and manipulated published text applicable to deployers of AI systems under Article 50(4) and (5) AI Act. The second draft incorporates feedback from stakeholders. The transparency obligations under the AI Act become applicable on 2 August 2026. The consultation ends on 30 March 2026.

28 February 2026Logistics & Infrastructure

Tech sectors AI, quantum, chips excluded from EU’s draft industrial law

It is reported that the European Union has revised its draft industrial law aimed at reducing strategic dependencies, now excluding advanced microchips, AI, and quantum technologies. The focus has shifted to sectors like electric vehicles, low-carbon metals, and other clean-tech industries. This narrowing of scope reflects ongoing debates over the products and sectors to be included in the Industrial Act, which also sets conditions for certain foreign investments within the bloc.

4 February 2026DeepfakesHuman Rights & Ethics

Momentum builds for EU AI Act to ban sexualized deep fakes

The EU Council and a broad cross-party coalition of lawmakers have initiated a movement to incorporate a specific ban on sexualised deepfakes into the EU AI Act. This legislative push gained significant momentum following the Grok scandal, involving the AI-driven generation of non-consensual intimate content targeting women and children, and is currently supported by member states including Spain, France, Ireland, and Slovenia. Despite this growing political backing, the proposal faces potential legal hurdles, as the Council’s legal service has cautioned that any new prohibition must align with the simplification scope of the European Commission’s AI omnibus proposal. The viability of this ban will be determined in the upcoming compromise text scheduled for release later in February 2026, which must balance the urgent call for explicit protections against non-consensual imagery with existing regulatory frameworks.

2 February 2026Human Rights & Ethics

Standard / Framework

EU Commission fails to produce high-risk AI guidelines on time

It is reported that the European Commission has missed a critical 2 February deadline to provide guidance on Article 6 of the EU AI Act, a delay that leaves operators of high-risk AI systems in a state of legal uncertainty regarding their documentation and compliance obligations. Although the Commission is currently integrating months of stakeholder feedback with plans to finalize the guidelines by March or April 2026, the postponement signals a broader struggle with implementation that has led to the proposal of a "Digital Omnibus" package intended to simplify high-risk definitions and delay enforcement by up to 16 months. While European Commission Deputy Director-General Renate Nikolay argued that more time is necessary to develop robust technical standards and provide certainty for innovators, the shift has drawn criticism for undermining the original legislative timeline and creating confusion about whether the August enforcement date remains viable. This regulatory bottleneck is further complicated by missed deadlines from technical standardization bodies and intense lobbying from both US and EU tech sectors, leading some negotiators to warn that the lack of clarity effectively turns a fixed legal framework into an unpredictable environment that erodes confidence in the Act’s effectiveness.

28 January 2026Copyright & IpGenerative AI

European Parliament adopts resolution on copyright and generative AI

The European Parliament's Legal Affairs Committee has adopted a resolution regarding copyright and generative AI (2025/2058(INI)) to address the legal status of AI-generated content and the use of protected works in training datasets. The resolution urges the European Commission to assess the current EU copyright framework's ability to handle legal uncertainties and competitive effects while ensuring that remuneration mechanisms continue to support artistic production. Key recommendations include an immediate remuneration obligation for general-purpose AI model providers using protected content, the establishment of machine-readable standards for "opt-out" mechanisms under the CDSM Directive, and the creation of a central register for these opt-outs managed by the EUIPO. The resolution demands strict transparency and source documentation from AI providers, proposing an irrebuttable presumption of use and liability for legal costs if these obligations are not met. The Parliament maintains that AI-generated content must remain ineligible for copyright protection and stay within the public domain, while tasking the Commission to develop measures against rights infringements caused by generative AI outputs.

23 January 2026SandboxData Privacy & Protection

France seeks to split AI Act delay from changes in bid for deeper reform

It is reported that France is quietly testing support among EU capitals to split the AI Act amendment package, the so-called AI omnibus, in a bid to reopen the door to deeper reform of the EU AI Act. France reportedly wants to separate the time-sensitive delay of high-risk obligations from broader substantive changes, lifting the pressure of the August 2026 deadline at a moment when Brussels is pushing to simplify regulation.

21 January 2026National Strategy

National Strategy

EU’s guidelines for high risk AI systems to see finalization delay

It is reported that the European Commission will miss the 2 February 2026 legal deadline for finalising AI Act guidelines on classifying high-risk systems. Instead the Commission will produce a draft for public consultation later this January 2026. Final adoption is now expected in March or April 2026.

13 January 2026Online Safety & Child ProtectionData Privacy & ProtectionDeepfakes

Other

Commission tells X to retain internal records on AI chatbot Grok

It is reported that the EU Commission has asked Elon Musk’s X to retain all internal documents and data relating to its AI chatbot Grok – using powers to regulate the social media platform under the bloc’s Digital Services Act (DSA). X’s controversial generative AI chatbot has come under fire in recent days over a so-called “spicy” mode that allowed Grok users to create sexualised deepfakes, including undressing pictures of women and minors. X has been asked to retain all data related to Grok, including internal documents, until the end of 2026, according to the Commission’s digital spokesperson Thomas Regnier. The Commission has not yet opened a formal investigation into Grok over the deepfake porn scandal. Separately, in her post on X, EU Commission tech chief, Henna Virkkunen warned X to quickly "fix" Grok - or face consequences under the DSA - "We will not hesitate to put the DSA to its full use to protect EU citizens" (source: https://x.com/HennaVirkkunen/status/2010802271144292571?s=20).

12 January 2026Data Privacy & Protection

EU states seeking position on AI Act amendments by April 2026

It is reported that the Cyprus presidency is aiming to secure a mandate by late March or early April 2026 to negotiate the AI omnibus with the European Parliament. The timeline reflects the need to pass the omnibus bill before the AI Act’s high-risk requirements take effect in August 2026, putting immediate pressure on MEPs to accelerate their work, which has yet to begin. The most contentious issue remains the proposed removal of the registration requirement, which Germany and Spain have openly opposed, and which is also likely to face resistance in the EU Parliament. However, there is broad support on other core elements of the package, including the legal basis for processing sensitive data, AI literacy, and the centralisation of certain enforcement tasks, alongside notable reservations and calls for clearer drafting.

17 December 2025Generative AIData Privacy & ProtectionCybersecurity

Committees’ dispute on AI Act amendments solved by EU Parliament

It is reported that the European Parliament has resolved its internal dispute over who will steer the AI Act amendment package. The Conference of Presidents is expected to confirm joint leadership by the Internal Market and Civil Liberties committees via written procedure, preserving the political balance that underpinned the original AI Act negotiations. With committee roles settled, attention now turns to the next political puzzle: who will hold the pen. The first move may come as soon as this week, with center-left Brando Benifei mounting a challenge to the EPP’s bid to secure the lead for Arba Kokalari. Who holds the pen will likely shape whether the amendments stay technical or turn political, especially around scope, sequencing, and enforcement mechanics.

17 December 2025Generative AIDeepfakes

European Commission opens consultation on code of practice on marking and labelling on AI-generated content

The European Commission opened a consultation on the first draft of the Code of Practice on marking and labelling of AI-generated content. The draft code aims to assist providers and deployers in fulfilling obligations under Article 50 of the AI Act, which requires providers to mark AI-generated or manipulated content in a machine-readable format and users deploying generative AI systems for professional purposes to label deepfakes and AI-text publications on matters of public interest. The Code of Practice comprises two sections, one for providers of generative AI systems, covering rules for marking and detecting AI content, and another for deployers, addressing the labelling of deepfakes and specific AI-generated or manipulated text concerning public interest matters. The finalisation of the Code is expected by June 2026, with the transparency rules covering AI-generated content under the AI Act becoming applicable on 2 August 2026. The consultation closes on 23 January 2026.

National Strategy✓ Official

EU Council approve EuroHPC initiative for start-ups to boost European leadership in trustworthy AI, proceeding to Parliament

The European Council has adopted a position on the proposal for a regulation amending Regulation (EU) 2021/1173 as regards an EuroHPC initiative for start-ups to boost European leadership in trustworthy AI. The amendment sets the framework for the activities of the EuroHPC Joint Undertaking (EuroHPC JU), as well as updates the EuroHPC JU governance structure. It aims to establish AI gigafactories in Europe and establish a quantum pillar in the activities of the EuroHPC JU. AI gigafactories will be supported through public-private partnerships. The amendment also outlines the framework for establishing and operating such gigafactories, as well as rules for funding and procurement. The amendment allows unused EU funds to be redirected to the project. Finally, the amendment introduces safeguards for the participation of third countries. As a next step, the European Parliament is expected to give its opinion on 17 December 2025, after which the regulation will be up for final adoption.

9 December 2025National Strategy

4 December 2025Generative AIData Privacy & Protection

EU parliamentary committees challenge process for AI law amendments

It is reported that two European Parliament committees (ITRE and JURI) have challenged plans for the passage of the Digital Omnibus amendments to the EU AI Act, an early sign that internal wrangling could slow the pace of the legislative process. Specifically, ITRE and JURI have challenged the allocation of responsibilities, reopening a long-standing issue. Several committees will only appoint rapporteurs in late January 2026, meaning the file will not move for several weeks. In the Council, the incoming Cypriot presidency has made no commitment to conclude the package during its semester, focusing instead on reaching an internal position. Even governments in favor of a pause are questioning the Commission’s discretionary approach and the lack of predictability around legal timelines. As time runs out, the core question becomes harder to ignore: what if the postponement isn’t adopted before the high-risk rules become enforceable? Poland has already floated the idea of a retroactive legislative pardon. Whether such a fix would withstand scrutiny before the EU Court of Justice is another matter.

4 December 2025Logistics & Infrastructure

European Commission and European Investment Bank Group partner to support AI Gigafactories

The European Commission and the European Investment Bank Group have announced a Memorandum of Understanding to collaborate on financing and supporting the establishment of "AI Gigafactories" across the EU. This effort is part of the broader AI Continent Action Plan and AI Innovation Package, which aims to position Europe as a global leader in trustworthy AI by providing significant investment and structural support, including an allocation of €20 billion for five initial AI gigafactories and 13 additional factories to boost the development and scaling of next-generation AI models and infrastructure.

4 December 2025Data Privacy & ProtectionOnline Safety & Child Protection

Working Paper✓ Official

EU Agency for Fundamental Rights publishes report on assessing high-risk AI fundamental rights risks

The European Union Agency for Fundamental Rights (FRA) has published a report on assessing high-risk AI Fundamental Rights Risks, examining how the EU AI Act governs high-risk AI systems and how these systems affect fundamental rights. The report makes a number of recommendations, including (1) the application of a broad interpretation by regulators of the Article 3(1) definition of an AI system to avoid the exclusion of less complex AI systems from the Act's regulatory scope; (2) a narrow interpretation of the Article 6(3) carveouts to the Annex III high-risk systems and emphasise the need for continued monitoring of the application of these carveouts; and (3) the provision of more guidance regarding the use of fundamental rights impact assessments, the establishment of an evidence base for assessing and mitigating fundamental rights risks, and proper oversight by bodies with fundamental rights expertise.

3 December 2025Generative AIData Privacy & ProtectionCopyright & Ip

Withdrawal of AI Liability Directive won't face challenge by EU lawmakers

It is reported than an overwhelming majority of lawmakers on the European Parliament's Legal Affairs Committee vote to decline a motion to sue the European Commission over its withdrawal of a legislative proposal for an AI Liability Directive. The committee's vote likely ends the proposal for the AI Liability Directive for good.

European Commission seeks feedback on AI regulatory sandboxes

The European Commission has initiated a public consultation on a draft implementing act to establish AI regulatory sandboxes under the AI Act. These sandboxes are designed to provide controlled environments where AI providers can develop, train, validate, and test innovative AI systems under regulatory supervision, including real-world conditions when appropriate. The initiative aims to foster AI innovation and support compliance with the AI Act. Stakeholders are invited to submit their feedback on the draft implementing act during the five-week consultation period. The consultation closes on 6 January 2026.

2 December 2025Sandbox

1 December 2025Copyright & Ip

European Commission opens consultation on guidance on machine-readable opt-out protocols regarding copyright chapter of GPAI Code of Practice

The European Commission opened a consultation as part of an initiative to formulate guidance on machine-readable opt-out protocols specified in the copyright chapter of the General-Purpose AI (GPAI) Code of Practice. Measure 1.3 of the Code of Practice commits signatories to identifying and complying with machine-readable protocols expressing opt-outs adopted by European or international standardisation organisations, as required by Article 53(1)(c) of the EU AI Act. The consultation asks stakeholders for input regarding existing solutions for rights reservation and calls for expressions of interest for participating in the identification of opt-out protocols, which the Commission will publish as a list. Consultation closes on 9 January 2026

24 November 2025Data Privacy & ProtectionCybersecurity

EU AI Act Whistleblower Tool launched

The European Commission has launched the AI Act Whistleblower Tool, enabling individuals to confidentially report suspected breaches of the AI Act directly to the EU AI Office. This secure platform allows whistleblowers to submit information anonymously in any official EU language, including supporting documents, and to monitor the progress of their reports without compromising their anonymity. The tool aims to identify potential violations that could threaten fundamental rights, health, or public trust, thereby contributing to the safe and transparent development of AI technologies in Europe. While robust confidentiality measures are in place, legal protection against retaliation under the Whistleblower Directive will apply to AI Act infringements starting from 2 August 2026; until then, confidentiality remains the primary safeguard for whistleblowers.

19 November 2025Data Privacy & ProtectionCybersecurity

EU releases digital omnibus to AI, cybersecurity and data rules

The European Commission has unveiled its new digital package which includes a digital omnibus that streamlines rules on AI, cybersecurity and data, complemented by a Data Union Strategy to unlock high-quality data for AI and European Business Wallets that will offer companies a single digital identity to simplify paperwork and make it much easier to do business across EU Member States. On the EU AI Act, the digital omnibus proposes: (1) Timeline changes (Article 113) — delaying the applicable date for high-risk AI system obligations (currently 2 August 2026) to either 6-12 months after technical standards are approved, or specific dates in December 2027 and August 2028 depending on the Annex listing; (2) Downgrading AI Literacy obligations (Article 4) — shifting from a legal requirement for providers and deployers to implement AI literacy to a requirement for the Commission and Member States to foster it and encourage providers/deployers to take measures; (3) EU AI Office scope expansion (Article 75) — designating the AI Office as the authority responsible for supervision and enforcement of certain AI systems based on general-purpose AI models where the model and system are developed by the same provider; (4) Limiting registration in public EU database (Article 6) — removing the obligation for providers to register an AI system in the public database if it's used in a high-risk domain (Annex III) but determined and documented by the provider as not high-risk due to the nature of use, though evidence of this assessment must still be provided upon request; and (5) Proportionality for small mid-caps (SMCs) (Article 99) — introducing smaller and more proportionate compliance penalties for SMCs (companies with up to 750 employees and under €150 million annual turnover), which complements the existing proportionality for SMEs and startups. The proposal is subject to trilogue negotiations over the coming months.

7 November 2025National Strategy

EU set to water down AI Act after Big Tech pressure

It is reported that the European Commission is proposing to pause parts of the EU AI Act amid intense pressure from big tech companies and the US government. The move follows months of urging by tech giants like Meta and Alphabet, and pressure from the Trump administration, which has warned against measures that could provoke trade tensions. Further details will emerge on 19 November where the regulatory simplification process of the AI Act and other digital regulations will be adopted.

6 November 2025Data Privacy & ProtectionOnline Safety & Child Protection

Planned EU AI Act changes to include centralized enforcement, regulatory tweaks

It is reported that amendments to the EU's AI Act will be proposed on 19 November, and will look to include easing compliance burdens and centralizing enforcement through the European Commission's AI Office. An early draft reportedly includes new oversight powers, expanded exemptions for small mid-cap companies, a new legal basis for processing sensitive data, a grace period for content labelling requirements, and softened registration duties. The leaked amendments are available here: https://cdn.netzpolitik.org/wp-upload/2025/11/EU-Kommission-Digital-Omnibus-B-KI.pdf

5 November 2025Generative AIDeepfakes

European AI Office initiates the drafting of Code of Practice on transparency of AI-generated content

The European AI Office has initiated the draft process for the Code of Practice on transparency of AI-generated content with a plenary meeting of independent experts. The Code of Practice aims to detail how providers and deployers of generative AI systems can comply with their transparency obligations laid down in Article 50(2) and (4) of the EU AI Act. The Code will facilitate the effective implementation of these transparency obligations, supporting practical arrangements for detection mechanisms and cooperation along the value chain to enable the public to distinguish AI-generated content and reduce risks of deception, manipulation, and misinformation. The drafting process engages working groups comprised of providers and deployers of AI systems and is expected to last 7 months, with the aim of publishing the final Code of Practice by June 2026, before the effective date of the transparency obligations on 2 August 2026.