Loading story…
The European Commission’s AI Office and national authorities have begun enforcing the EU AI Act, opening a new compliance phase for AI systems used or sold in the bloc. The rollout includes multiple reporting mechanisms for suspected violations, including a general complaints tool, an anonymous whistleblower channel, and a downstream provider complaints process tied to obligations for general-purpose AI models. Officials can impose penalties of up to €15 million or 3% of worldwide annual turnover, although early enforcement is expected to emphasize corrective and suspension orders that could disrupt providers more than one-time fines.
The enforcement push is landing as organizations assess how the Act applies to AI agents, even though the law does not explicitly use that term. Guidance cited by industry observers indicates that agents accessible to EU users are generally treated as covered AI systems and must at least meet Article 50 transparency duties, such as informing users they are interacting with AI and labeling perceptible AI-generated synthetic content. Providers that materially modify models beyond defined thresholds may face added obligations under Articles 53 to 55, while agents used in safety components or other high-risk use cases can also fall under the Act’s stricter Chapter III requirements.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The Netskope article says the compliance deadline for Article 50 transparency obligations was August 2, 2026. These obligations require deployers of AI systems accessible to EU citizens to disclose AI interactions and label perceptible AI-generated content.
The European Commission’s AI Office and national authorities began enforcing the EU AI Act on 2 August 2026. This marked the start of active enforcement of the bloc’s AI regulatory framework.
Anthropic disclosed on 30 July that three Claude models breached real organizations during cybersecurity evaluations. The company said the incidents happened after a misconfiguration exposed supposedly isolated test environments to the live internet.
The EU’s Digital Omnibus on AI entered into force, revising the AI Act’s implementation timeline. It deferred high-risk obligations for standalone Annex III AI systems from August 2, 2026 to December 2, 2027, and pushed obligations for AI embedded in regulated products from August 2027 to August 2028.
The Netskope article states that the EU AI Act was ratified in 2024, before AI agents became a prominent concept.
The AI Office launched multiple reporting mechanisms for suspected AI Act violations, including a general complaints tool, an anonymous whistleblower tool, and a downstream provider complaints channel. These channels support complaints about providers, deployers, and certain general-purpose AI model obligations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securitysenses.com
Open sourcesecuritysenses.com
Open sourcecybercenter.space
Open sourcenetskope.com
Open sourcehelpnetsecurity.com
Open sourceartificialintelligenceact.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Union has adopted Regulation (EU) `2024/1689`, creating a harmonised legal framework for the development, marketing, deployment, and use of AI systems across the bloc. The law applies a risk-based model that bans certain uses deemed unacceptable, including social scoring, manipulative AI, untargeted facial-image scraping, and some emotion-recognition and biometric-categorisation practices, while imposing mandatory obligations on high-risk AI systems. It also extends in some cases to providers and deployers outside the EU when AI outputs are intended for use in the Union. The regulation sets detailed requirements for high-risk AI used in areas such as critical infrastructure, education, employment, essential services, law enforcement, migration and border control, justice, and elections. Providers, importers, distributors, authorised representatives, and deployers must meet obligations covering risk management, data governance, technical documentation, logging, transparency, human oversight, robustness, accuracy, cybersecurity, post-market monitoring, accessibility, and AI literacy. The Act also places strict limits on real-time remote biometric identification in publicly accessible spaces, with narrow exceptions, authorisation requirements, and oversight, while preserving the application of existing EU rules on data protection, consumer protection, product safety, liability, and related sectoral frameworks.
Jul 31, 2026
EU Parliament and Council negotiators reached a provisional agreement to amend the **EU Artificial Intelligence Act**, adding a ban on AI systems used to create **non-consensual sexualized depictions of identifiable people** and **synthetic child sexual abuse material**, including so-called **"nudifier" apps**. The deal also advances related transparency rules by setting watermarking obligations for AI-generated content to **2 December 2026**, while the new ban would also take effect on that timeline if formally adopted. The agreement still requires final approval by both Parliament and the Council. The package also delays several AI Act compliance deadlines and simplifies parts of the regime under the EU's digital omnibus effort. Obligations for standalone high-risk AI systems would move to **2 December 2027**, while AI used as safety components in products covered by sectoral safety laws would shift to **2 August 2028**. Negotiators also narrowed some machinery-related requirements, allowed limited use of sensitive personal data to detect and correct algorithmic bias, extended certain SME exemptions to small mid-cap firms, and centralized enforcement for some general-purpose AI systems through the **EU AI Office**.
Jun 29, 2026
European policymakers advanced new measures aimed at limiting **AI-enabled sexual abuse and impersonation harms**, with the **European Council** proposing amendments to the AI Act that would ban AI systems used to generate non-consensual intimate imagery, including **nudification tools** and child sexual abuse material. The proposal also tightens standards for processing sensitive personal data, and follows parallel action in the **European Parliament**, increasing the likelihood that a negotiated EU position will include explicit restrictions on these abusive AI uses. The push comes amid broader concern over the real-world impact of generative AI, including the recent backlash over AI-generated intimate imagery. Separately, **YouTube** expanded access to its AI-driven likeness detection system for **government officials, journalists, and political candidates**, allowing eligible users to identify AI-generated impersonation videos and request removal when content violates platform privacy rules. The system is designed to detect synthetic uses of a person’s likeness while preserving exceptions for parody, satire, and other public-interest expression. Other cited items were not part of the same event: one covered the EU’s extension of voluntary **CSAM** detection rules under the ePrivacy framework, and another reported research showing major chatbots sometimes provided violent guidance to would-be attackers.
Jun 29, 2026