Welcome to the EU AI Act Newsletter, a brief biweekly newsletter by the Future of Life Institute providing you with up-to-date developments and analyses of the EU artificial intelligence law.
Legislative Process
Commission starts enforcing AI Act rules and new transparency requirements: The European Commission reports that, from 2 August 2026, its AI Office, alongside national authorities, has begun enforcing the AI Act. Additionally, the new transparency rules have also taken effect. Under those rules, chatbots and other interactive systems must tell users they are dealing with AI rather than a human, deepfakes must be labelled, and AI-generated or altered content must carry machine-readable marks so it can be detected more easily. Alongside this, the Commission published a first list of more than 180 organisations that have signed the Code of Practice operationalising those transparency rules. Enforcement now also covers prohibited practices and providers of general-purpose AI models, including their documentation, copyright policy and training-data summaries, with extra obligations for models posing systemic risks. Responsibility for enforcing the transparency rules and prohibited practices is shared between the AI Office, national competent authorities and the European Data Protection Supervisor. The AI Omnibus, meanwhile, postpones the high-risk rules to 2 December 2027 and the rules for high-risk AI systems integrated into regulated products to 2 August 2028.
New AI Act enforcement tools: The European Commission's AI Office outlines the channels it has launched to support enforcement of the AI Act. Chief among them is the Complaint Tool, through which natural and legal persons can report alleged infringements by providers or deployers of AI systems falling under the AI Office’s exclusive competence, on the basis of Article 85. Because complaints must stay within that scope, the tool does not cover infringements of other EU or national laws. Alleged breaches of Articles 53 to 55 go instead to a dedicated channel for downstream providerswho may complain under Article 89(2) where they believe the provider of a general-purpose AI model has failed on technical documentation, copyright policy, training-data summaries, incident reporting and cybersecurity or, for models with systemic risks, risk assessment and mitigation. Separately, a Whistleblower Tool lets those working with providers report possible violations securely.
Analyses
Europe’s AI safety rules take on US rogue agents and Chinese ambitions: Pieter Haeck from POLITICO reports that the AI Act's second anniversary on 2 August triggered new Commission powers over how companies handle systemic risks from their most advanced models. The AI Office can now request documentation, conduct evaluations and even request access to the models, and can fine companies up to 3 per cent of global turnover. The powers follow the first known case of an autonomous AI agent going rogue, when an agent driven by two OpenAI models hacked into the platform Hugging Face, a breach OpenAI called “unprecedented”. US lawmakers responded with a bipartisan House bill, the “AI Kill Switch Act”. Meanwhile, Xi Jinping has declared Beijing ready to lead global AI governance, with 29 countries signing a pact in Shanghai that is light on specifics. Earlier this month, think tanks, parliamentarians and experts urged the AI Office in an open letter to use its powers fully.
Commission’s digital kingpin extended for twelfth year: Théophane Hartmann from Euractiv reports that Roberto Viola, who has led the Commission’s Connectivity directorate (DG CNECT) since 2015, will stay in post until 30 September 2027, according to a Commission spokesperson, rather than leaving when his contract was due to expire in September 2026. This marks the second such one-year extension, granted in accordance with the EU staff regulations, under which officials reaching the age of 66 must retire unless they request and are granted annual extensions, up to the age of 70; Viola turns 67 in September. Over his time at the helm of DG Connect, he has overseen the drafting and execution of several landmark tech rules, among them the GDPR, the Digital Services Act and Digital Markets Act governing platforms, and the AI Act.
Advancing responsible AI across Europe: OpenAI sets out in a blog post how it has strengthened its approach to safety, security, transparency and provenance in line with the EU framework as the AI Act enters its next phase. The company argues that such rules must be pragmatic, proportionate and risk-based to advance governance while supporting innovation. OpenAI also notes that it contributed to and endorsed both the General-Purpose AI Code of Practice and the Code of Practice on Transparency of AI-Generated Content. Its support for the former rests on internal governance alongside collaboration with external experts, governments and peers, including pre-release testing, system cards, its Red Teaming Network and the public Model Spec. For provenance, OpenAI uses two reinforcing systems, Content Credentials (C2PA) and SynthID watermarks, and is now extending them to audio outputs. It says it will widen provenance measures across other modalities, text included, as standards and tooling mature.
Jobs
Large hiring round at the EU AI Office: The European Commission has opened a call of interest for around 40 contract agent posts dedicated to enforcing the AI Act, recruiting Technology Specialists, Legal Officers, Operations Specialists and Paralegals, primarily into the units responsible for AI regulation and compliance (CNECT A.2) and AI safety (CNECT A.3). On the technical side, the call seeks expertise in model evaluations and red-teaming, interpretability and alignment, model weight security and confidential computing, AI-enabled cyber threats, agentic AI, and compute and hardware supply chains. It also looks for risk-area specialists on loss of control, CBRN, cyber and harmful manipulation, as well as strategic foresight and quantitative analysis, including capability forecasting and game-theoretic modelling of regulatory and competitive dynamics. Contracts run initially for one year and may be extended up to six. Applicants must be EU citizens, will be based in Brussels, and should apply by midday on 8 September 2026.
We’ve built the most comprehensive website on the EU AI Act to help answer all your questions. Here are a few of our most popular resources used by 60,000+ professionals every week:
AI Act Explorer: Explore the official AI Act text on any device, in any EU language, with helpful cross-links, added context, and more.
Compliance Checker: In just 10 minutes, figure out exactly what your business or organisation must do to comply with the AI Act.
High-level Summary: A short overview of the AI Act, with a breakdown on risk categorisation, obligations, prohibited systems, and timelines.
Small Businesses’ Guide: Everything you need to know, for small and medium-sized enterprises (SMEs) in the EU and beyond.
One thing I’ve been wondering about as enforcement begins is whether the AI Act’s capacity to observe risk can eventually match its regulatory reach.
The Act can reach certain providers and deployers outside the EU when their AI output is used inside the Union. Article 85 also gives natural and legal persons a complaint route, while enforcement is handled through the AI Office and national authorities. So there is clearly machinery here. (Eur-Lex)
The part I’m less certain about is what happens at the outer edges of EU-linked supply chains.
Europe is heavily dependent on third countries for a number of critical inputs, and African economies are an important part of several of those relationships, alongside major agricultural and other supply chains. The EU itself is actively trying to strengthen and diversify those external dependencies. (European Commission)
That creates a fairly significant asymmetry: the regulatory and surveillance institutions are predominantly inside a highly developed European market, while some of the earliest real-world effects of an AI system could appear much farther upstream, among producers, contractors, smaller businesses or communities with considerably less institutional leverage.
That may have been easier to overlook in older regulatory environments. With AI, I’m not sure that is a safe assumption.
Imagine the same AI system produces small but correlated errors across several thousand suppliers. Individually, the resulting incidents might look trivial, local or unrelated. They may occur in different countries, languages and commercial relationships. Yet economically they could be manifestations of the same underlying model behavior.
If only a small fraction become complaints, or if those complaints reach different authorities without being connected, the regulator could end up with data that is perfectly accurate about what it saw, while still being materially incomplete about what was actually happening.
That is where I see a potential Black-Swan-style economic problem. Not a pure Black Swan in the technical sense, because the vulnerability can be imagined beforehand, but a tail event whose scale appears unexpectedly large because its precursor signals were dispersed outside the regulator’s strongest field of observation.
A risk-based law ultimately depends on the quality of the information feeding its understanding of risk.
So perhaps extraterritorial reach eventually requires something analogous to decentralized observational capacity as well, not necessarily EU field offices, but trusted regional mechanisms capable of receiving, validating and aggregating signals where important EU supply chains actually originate: cooperation with local regulators, producer associations, universities, trade bodies, civil society or other credible intermediaries.
Otherwise there is a possibility that jurisdiction becomes geographically broader than situational awareness.
I don’t take that as an argument against the AI Act. It may actually be an argument for strengthening its credibility as implementation matures. If the EU intends to regulate AI effects that cross borders, ensuring that weak signals from the less powerful side of those borders remain visible may become as important as the enforcement powers themselves.
I’m curious whether this is already being addressed somewhere in the implementation architecture that I’ve missed.😊
Two reporting channels opening at once changes the practical risk picture for small firms. Complaints and whistleblower reports do not require a regulator to notice you first, so exposure now starts with a customer or an employee rather than an inspection. I run a finishing business in Lithuania, and the response that scales at my size is narrow scope: AI goes to measurements and estimates, nothing customer-facing, so the labelling duties largely do not bite. The Commission has not published how it will triage incoming reports, so volumes and response times remain unknown.