Loading story…
The EU Digital Omnibus amends targeted provisions of the EU AI Act, extending compliance deadlines for high-risk systems rather than delaying the regulation wholesale. Providers of Article 6(2)/Annex III high-risk AI systems now have until 2 December 2027, while Article 6(1)/Annex I product-related systems have until 2 August 2028 to comply. The measure entered into force on 27 July 2026 following a provisional agreement reached in May.
Transparency requirements under Article 50 for AI-generated content generally remain applicable from 2 August 2026, although eligible systems already placed on the market receive a marking-compliance grace period until 2 December 2026. The amendments also allow broader processing of sensitive data for bias detection and mitigation, permit reuse of DPIA material in fundamental-rights impact assessments, ban AI intended or foreseeably usable to create non-consensual intimate material or child sexual-abuse material, and extend selected proportionality measures to small mid-cap enterprises.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
The final AI Omnibus regulation entered into force, amending selected EU AI Act provisions. It revised high-risk AI compliance timing, bias-data processing rules, safety-component criteria, assessment reuse, proportionality measures, and supervisory competences.
European Parliament and Council negotiators reached a provisional agreement on the separate Digital Omnibus on AI, including changes to high-risk AI Act compliance timelines.
The European Commission published a broader Digital Omnibus Package proposing amendments affecting the GDPR, NIS 2, and other EU digital legislation.
The AI Omnibus prohibits placing on the EU market, and deploying, AI systems intended to generate or manipulate non-consensual intimate material or child sexual abuse material. The prohibition can also cover foreseeable and reproducible harmful outcomes where adequate technical safety measures are absent.
Article 50 transparency requirements generally began applying to AI-generated content, requiring relevant providers to make synthetic audio, image, video, or text outputs machine-readably detectable as artificial or manipulated. Qualifying systems already on the market received a limited transition period for the marking requirement.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
EU Parliament and Council negotiators reached a provisional agreement to amend the **EU Artificial Intelligence Act**, adding a ban on AI systems used to create **non-consensual sexualized depictions of identifiable people** and **synthetic child sexual abuse material**, including so-called **"nudifier" apps**. The deal also advances related transparency rules by setting watermarking obligations for AI-generated content to **2 December 2026**, while the new ban would also take effect on that timeline if formally adopted. The agreement still requires final approval by both Parliament and the Council. The package also delays several AI Act compliance deadlines and simplifies parts of the regime under the EU's digital omnibus effort. Obligations for standalone high-risk AI systems would move to **2 December 2027**, while AI used as safety components in products covered by sectoral safety laws would shift to **2 August 2028**. Negotiators also narrowed some machinery-related requirements, allowed limited use of sensitive personal data to detect and correct algorithmic bias, extended certain SME exemptions to small mid-cap firms, and centralized enforcement for some general-purpose AI systems through the **EU AI Office**.
Jun 29, 2026
The European Union has adopted Regulation (EU) `2024/1689`, creating a harmonised legal framework for the development, marketing, deployment, and use of AI systems across the bloc. The law applies a risk-based model that bans certain uses deemed unacceptable, including social scoring, manipulative AI, untargeted facial-image scraping, and some emotion-recognition and biometric-categorisation practices, while imposing mandatory obligations on high-risk AI systems. It also extends in some cases to providers and deployers outside the EU when AI outputs are intended for use in the Union. The regulation sets detailed requirements for high-risk AI used in areas such as critical infrastructure, education, employment, essential services, law enforcement, migration and border control, justice, and elections. Providers, importers, distributors, authorised representatives, and deployers must meet obligations covering risk management, data governance, technical documentation, logging, transparency, human oversight, robustness, accuracy, cybersecurity, post-market monitoring, accessibility, and AI literacy. The Act also places strict limits on real-time remote biometric identification in publicly accessible spaces, with narrow exceptions, authorisation requirements, and oversight, while preserving the application of existing EU rules on data protection, consumer protection, product safety, liability, and related sectoral frameworks.
Jul 31, 2026
The European Commission’s AI Office and national authorities have begun enforcing the **EU AI Act**, opening a new compliance phase for AI systems used or sold in the bloc. The rollout includes multiple reporting mechanisms for suspected violations, including a general complaints tool, an anonymous whistleblower channel, and a downstream provider complaints process tied to obligations for general-purpose AI models. Officials can impose penalties of up to **€15 million or 3% of worldwide annual turnover**, although early enforcement is expected to emphasize corrective and suspension orders that could disrupt providers more than one-time fines. The enforcement push is landing as organizations assess how the Act applies to **AI agents**, even though the law does not explicitly use that term. Guidance cited by industry observers indicates that agents accessible to EU users are generally treated as covered AI systems and must at least meet **Article 50** transparency duties, such as informing users they are interacting with AI and labeling perceptible AI-generated synthetic content. Providers that materially modify models beyond defined thresholds may face added obligations under **Articles 53 to 55**, while agents used in safety components or other **high-risk** use cases can also fall under the Act’s stricter Chapter III requirements.
Aug 13, 2026