AI Regulation Tracker / Regional hub

Europe AI Regulation Tracker

The EU AI Act duties and the national laws and regulators across Europe that change what a professional must do, organized by jurisdiction. We update this as new rules land.

Maintained by The Leveraged Years Regulatory Research · Last updated July 11, 2026

European Union

Solicitors Regulation Authority, Warning Notice: Misuse of AI, 17 August 2026Published and operative as guidance. It creates no new rule, but the SRA says it will have regard to it when exercising its regulatory functions and that failing to have proper regard risks disciplinary action.
Northern Ireland's Draft Artificial Intelligence Strategy, consultation by The Executive Office, open 12 AugusNot binding. This is an open consultation on a draft strategy. Neither the consultation nor the strategy it would produce creates a legal obligation. Responses received after the closing dat
Legal services advisory AI Growth Lab: overview, published by the Department for Business, Innovation, ScienceNot binding, and not a safe harbour. This is a voluntary advisory sandbox. The overview states plainly that participation does not provide regulatory approval, endorsement or exemptions from
Public consultation on the European Commission proposal for a Cloud and AI Development Act (CADA), Department Not binding on anyone. A consultation opened by the Department of Enterprise, Tourism and Employment to build an evidence base on a European Commission proposal that is itself still a propos
Growing up in the online world: government response, CP 1643, ISBN 978-1-5286-6739-5, Department for Science, A policy document, not law. The response states commitments; the department says detailed definitions of which chatbots fall in scope will be set out in regulations in due course.
Appointment of the Board of Oifig IS na hEireann (AI Office of Ireland) under the Regulation of Artificial IntAn appointment, not a rule. It creates no obligation on any provider or deployer, but it completes the governance layer of the body that coordinates Ireland's EU AI Act implementation.
Ustawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji, Dz.U. 2026 poz. 1003Binding statute. Signed by President K. Nawrocki, promulgated 27 July 2026 as Dz.U. 2026 poz. 1003, in force 14 days later. Parts of it are staged three months out.
Garante per la protezione dei dati personali, provvedimento n. 577 del 23 luglio 2026, doc. web 10281021Binding measure, in force. A prohibition on further processing under Article 58(2)(f) GDPR plus a formal warning under Article 58(2)(b). No fine was imposed.
Landgericht Muenchen I, 42. Zivilkammer, Urteil vom 31.07.2026, Az. 42 O 763/25 (GEMA v Suno)A first instance judgment, and expressly not final. The court's own press release states that the judgment is not legally binding, which means an appeal remains open.
Bafin press release of 29 July 2026 on the Gesetz zur Durchfuehrung der KI-Verordnung, including the KI-MarktuBinding. The implementing act entered into force on 29 July 2026 and BaFin is now the market surveillance authority for AI systems that stand in direct connection with a regulated financial
Autoriteit Persoonsgegevens news item De FRIA voor AI-systemen komt eraan: bereid u voor, with the publicationThe guidance and the pilot are not binding. The FRIA obligation itself is, and it starts in December 2027; participation in the pilot is voluntary and the AP states explicitly that it is not
CNPD Plano Plurianual de Atividades 2027-2029, Relatorio da Consulta Publica, and Plano de Atividades para 202Not binding on anyone. This is the CNPD's own multiannual activity plan for 2027-2029 plus its annual plan for 2027, approved after a public consultation. It creates no obligations for contr
CNIL and CIANum note exploratoire, IA agentique et protection des donnees personnelles: equation a inconnues mNot binding. This is an exploratory note co-written by the CNIL and the CIANum. It states positions and identifies problems; it creates no obligation and announces no enforcement position.
ACPR, L'equite algorithmique dans le secteur financier, document de reflexion, July 2026, plus consultation quNot binding. This is a discussion paper issued for public consultation. The ACPR states in the paper itself that it does not express an official ACPR position.
Ticari Reklam ve Haksiz Ticari Uygulamalar Yonetmeliginde Degisiklik Yapilmasina Dair Yonetmelik, Resmi GazeteBinding. This is a published regulation, not guidance. It was promulgated in the Official Gazette on 1 July 2026 and article 15 sets entry into force on 1 August 2026.
UODO, wystapienie DPNT.0623.18.2026 to the Minister of Family, Labour and Social Policy, 16 July 2026Not binding. This is a wystapienie, a formal letter from the President of UODO to a minister asking that legislative work begin. It creates no new obligation and starts no proceeding.
UODO, Listy pytan inicjalnych: Ochrona danych osobowych w kontekscie systemow sztucznej inteligencji, 6 AugustNot binding. UODO states the questions are not a binding interpretation of the provisions and do not determine GDPR compliance, and that the answers do not have to be presented to the superv
Ministerstwo Cyfryzacji announcement, Piaskownice regulacyjne AI, 10 August 2026This is a ministry announcement describing a mechanism created by the AI systems act signed by the President. The announcement itself binds nobody; it explains what the statute sets up. No c
O peri tis Technitis Noimosynis Nomos tou 2026 (draft Artificial Intelligence Law of 2026), public consultatioA draft bill in public consultation. It binds nobody. Comments are open on the e-Consultation platform until 16 September 2026 and the text can change before anything goes to the House.
O peri Rythmiseos Ilektronikon Epikoinonion kai Tachydromikon Ypiresion (Tropopoiitikos) Nomos tou 2026, draftA draft amending bill in open public consultation. It binds nobody. Comments close 16 September 2026 at 23:50 on the e-Consultation platform.
MFSA Circular, Frontier Artificial Intelligence Models and the Evolving Cyber-Threat Landscape, 5 August 2026A circular, not a rule. The Authority states it is not introducing a separate set of supervisory expectations specifically addressing frontier AI models. It applies to all Licence Holders; i
CTU press release of 31 July 2026 on the Article 50 AI Act transparency rulesA press release, not an instrument. It creates no obligation of its own and binds nobody. The obligations it describes come from Article 50 of the AI Act, which the regulator says takes effe
MIRRI SR press release of 13 August 2026 on the reworked draft Slovak act on artificial intelligenceNot law, and not binding on anyone. This is a ministry press release about a bill that has just been reworked and sent onward in the legislative process. It still has to clear the Legislativ
Government announcement of 7 August 2026 on the launch of the mihivatal.gov.hu websiteAn announcement of a website, not an instrument. It binds nobody and changes no obligation. What it does is give members of the public a named government address for AI grievances.
Draft Law on the Implementation of the European Union Artificial Intelligence Act, project No. XVP-1564Not law. A draft law that has only passed the presentation stage in the Seimas and returns to the plenary in the autumn session.
TTJA guidance page Tehisintellektisusteemid (Artificial intelligence systems), Estonian Consumer Protection anGuidance on an authority's website. It binds nobody, creates no new obligation, and describes TTJA's supervisory role in the future tense throughout.
ANCOM press release, Regulamentul privind inteligenta artificiala in Romania: stadiul actual al cadrului de imA press release, not an instrument. It binds nobody. Its central factual claim is that Romanian authorities cannot verify or sanction breaches until a national law, still in drafting, enters
Avukatlar Icin Yapay Zeka Kullanimi Tavsiye Rehberi and Yapay Zeka ve Avukatlik Calistayi Sonuc Raporu, TurkiyA recommendation guide and a workshop report from a professional body. Neither is a disciplinary rule, and the announcement describes them as recommendations shared with the profession and t
Law of the Republic of Azerbaijan No. 387-VIIQD of 21 April 2026 amending the Criminal Code, the Criminal ProcBinding. This is an adopted law signed by the President, not a draft or a consultation. The e-qanun record carries the status Quvvededir, meaning in force.
European Union (Artificial Intelligence) (Designation) (Amendment) Regulations 2026, S.I. No. 405 of 2026Binding. This is a statutory instrument made under section 3 of the European Communities Act 1972, signed and sealed, with notice of its making published in Iris Oifigiuil. It amends S.I. No
Practice Direction CA16, Practice Direction on the responsible use of Generative Artificial Intelligence in CoBinding on practice before the Court of Appeal. Ms Justice Caroline Costello issued it as President under the general authority of the office, the Court's inherent power to regulate its own
AI Omnibus enters into force and fixes the amended calendarRegulation (EU) 2026/1744 is binding from 27 July 2026, but Annex III high-risk duties apply from 2 December 2027 and Annex I from 2 August 2028.
EASA proposes Level 3 AI certification guidance for aviationEASA's AI concept paper issue 3 proposes Level 3 machine-autonomy certification guidance for aviation.
ESMA statement on AI for MiFID investment firmsESMA's statement sets expectations for how MiFID investment firms use AI while keeping governance and client-protection duties intact.
EU supervisors widen AI cyber duty via DORAThe EBA, EIOPA and ESMA jointly backed the ESRB frontier-AI cyber warning, making it a DORA supervisory expectation for banks, insurers and investment firms.
MDCG guidance on AI medical devices and the AI ActMDCG 2025-6 guidance explains how AI medical device rules interact with the EU AI Act.
Serious-incident reporting clockReport serious incidents in 15 days, 10 for a death, 2 for critical-infrastructure disruption.
Software and AI as a productStrict no-fault liability for defective software and AI, from December 9.
Article 5 intimate-image banA new ban on AI that generates non-consensual intimate imagery, effective December 2.
Article 50 transparencyMark AI-generated content and disclose deepfakes and chatbots, from August 2.
Omnibus high-risk delayHow the simplification package retimes high-risk duties and penalties.
Article 4 AI-literacy dutyA duty to ensure staff have a sufficient level of AI literacy.
EU AI Act Article 50 content labelsMark and disclose AI-generated content from August 2 or risk fines up to 15 million euro or 3 percent of turnover.
EU AI Office gains GPAI enforcementFrom August 2 the Commission can compel documents, evaluate GPAI models, order withdrawal and fine providers.
EU Digital Omnibus defers high-risk AIHigh-risk AI Act duties are deferred to December 2027 and August 2028, and AI nudifiers and CSAM are banned, pending publication.
EDPB web-scraping AI guidelinesNew guidelines confirm the GDPR applies to web scraping for AI even on public data, open to consultation to October 30.
EDPB tightens the anonymisation testA three-part test tightens when AI data stays outside the GDPR, open to consultation to October 30.
ESRB warns AI is a systemic cyber risk to financeThe ESRB warned that frontier AI models pose a systemic cyber risk to EU finance, with the EBA, EIOPA and ESMA concurring under DORA.
ECB: banks must file AI cyber plans by Oct 31The ECB told significant euro area banks to file AI cyber-resilience action plans with their supervisory teams by October 31, 2026 under DORA.
Council of Europe AI treatyThe first binding international AI treaty advances toward signature and ratification across Council of Europe states.
Article 50 reaches US law firmsArticle 50 transparency duties reach non-EU firms, including US law firms serving EU clients, from August 2, 2026.
EU cybersecurity and AI planThe EU cybersecurity action plan folds AI systems into critical-infrastructure and resilience expectations.
EU-Mercosur data and AI termsThe interim EU-Mercosur deal turns data and AI compliance into market-access conditions.
EU AI Office publishes non-binding frontier AI reportThe EU AI Office published a non-binding expert forum report on frontier AI risk and oversight direction.

Germany

Germany splits AI Act supervision across BaFin and the LaenderThe implementing act, BGBl. 2026 I Nr. 223, sends financial entities to BaFin, some Annex III categories to a dedicated chamber and Land bodies to the Laender.
Munich injunction treats Google AI output as its own contentA Munich court injunction treats Google's AI output as its own content, making it a direct infringer.
KI-MIG names the enforcerThe Bundesnetzagentur would be Germany's lead AI market-surveillance authority.

Spain

Galicia's regional audit body adopts binding internal AI rules for its own staffBinds only the Consejo de Cuentas de Galicia and its own personnel. In force 21 August 2026. AI output is not sufficient audit evidence on its own, and using AI to profile people is prohibited.
AESIA and a fine scheduleA draft law with fines up to 35 million euros, enforced by AESIA.
Spain AEPD fines unlawful AI deepfake image processingSpain's AEPD fined the unlawful processing of personal data behind AI deepfake image generation.

Italy

Tuscany passes a regional AI statute that creates no new obligationsLegge regionale 15/2026, published in the BURT on 31 July 2026. Article 1 states the Region acts without creating new obligations for AI creators and users; the words sanzione and vigilanza do not appear in the text. Applies to the regional administration, not the market.
Italy would seat the Garante as AI Act market surveillance authorityA draft decree would designate the data protection authority as AI Act market surveillance authority for the Article 74(8) categories, the opposite institutional choice from Germany's. The decree is a draft and the Garante's workplace ask is an observation, not a condition.
Rome court annuls OpenAI Italian fine on jurisdictionA Rome court annuls the Garante's OpenAI fine on jurisdictional grounds, reshaping EU enforcement.
Italy AGCM opens Microsoft 365 Copilot AI bundling probeItaly's competition authority probes whether Microsoft 365's Copilot AI bundling and default price rise misled consumers.
Law 132/2025 decreesWorkplace-AI notice, a health-data notification duty, and liability rules advancing.
Italy fines Character.AI over minorsThe Garante fined Character.AI's owner and ordered working age verification and private-by-default minor profiles within 120 days.

France

APIG refers Google AI Overviews to the AutoriteThe press alliance asks the regulator to enforce commitments it says run until 2027 against a later AI feature. No decision yet.
CNIL on AI as personal dataA trained model may itself be personal data under the GDPR.
France moves to name CNIL a lead AI Act regulatorFrance's DDADUE bill moves to name CNIL among the lead AI Act market-surveillance authorities.

Ireland

High Court rules on GenAI court documentsPractice Direction HC 142 comes into operation 1 September 2026 and requires independent verification of generative-AI-assisted court material, with specific disclosure safeguards.
AI Office is now statutoryThe 2026 Act establishes the AI Office as an independent statutory coordinating authority for EU AI Act implementation. It does not add duties beyond the EU Regulation.
Ireland AI Bill: Enforcers and Fines Up to 7%Ireland's AI Bill names the Data Protection Commission, Central Bank and CCPC as market-surveillance authorities, with fines up to 7% of global turnover.

Poland

Poland publishes its AI systems act and designates KRiBSIDziennik Ustaw 2026 poz. 1003 makes the act law and Article 5(1) names KRiBSI as the Article 70(1) market surveillance authority.
The KRiBSI watchdogA new AI oversight body and EU single point of contact.
Poland AI Act clears ParliamentThe AI systems act cleared the Sejm and went to the President, with KRiBSI as enforcer; not yet signed.

Netherlands

Decentralized oversightEight sectoral supervisors coordinated by the data authority and the RDI.
Dutch regulator: sign AI transparency code by 22 JulThe Dutch AP urges signing the EU AI transparency Code before the July 22, 2026 first-signatory cut-off, with Article 50 duties applying August 2.
Dutch interim order: X must stop Grok nudify and CSAM imagesA Dutch court issued an interim order requiring X to stop Grok from generating nudify and CSAM imagery.
Dutch appeals court upholds order to open X moderation dataA Dutch appeals court upheld an order requiring X to open automated moderation data under Article 15 access rights.

Nordics

Finland switches on supervisionNational AI Act supervision is live, with Traficom as the EU contact point.

Norway

Norway's KI-loven still described as forthcoming after the EU's August dateNorway takes the AI Act through the EEA Agreement, so it binds when the KI-loven takes effect. Nkom, the designated coordinating supervisory authority, still describes the law as on its way.
Norway: smart-glasses rules = same as a phone cameraNorway's Datatilsynet says smart-glasses filming follows phone-camera rules, and publishing recordings of people in public triggers the GDPR and consent.

Denmark

Denmark's AI sandbox reports set the barDenmark's Datatilsynet published AI sandbox final reports covering legal basis, controller roles, AI Act risk classification and prohibited-practice screening.

Sweden

Sweden IMY reprimands Securitas over AI driver camerasSweden's IMY reprimanded Securitas over AI-driven driver camera surveillance and the data-protection limits on monitoring workers.
EU sets AI web-scraping rules, IMY led the draftEDPB Guidelines 03/2026, led by Sweden's IMY, set legitimate-interest limits and sensitive-data filtering for AI scraping, open to consultation to October 30.
Sweden police live facial recognitionLive police facial recognition is in force under EU AI Act Article 5, with court authorization and narrow triggers.
Sweden picks PTS to police the AI ActSweden's inquiry SOU 2025:101 proposes a complementary AI Act law naming PTS lead market surveillance authority, with a sandbox and sanctions.

Greece

Greece names its AI Act enforcersA draft bill names the HDPA as market-surveillance authority and EETT as notifying authority.

United Kingdom

MHRA Draws the AI Scribe Device Line at the Claim, Not the TechMHRA guidance clarifies that transcription, summarising, coding and letter-drafting are not medical devices, while suggested diagnoses, autonomous ordering or diagnostic marketing claims make an AVT product a device, Class IIa where it allows direct diagnosis.
Court of Appeal treats AI witness preparation as prohibited coachingR v FGD holds that witness training is forbidden and that witnesses should be firmly discouraged from using AI to prepare evidence.
ICAEW adds binding AI ethics duties for its membersThe ICAEW Code of Ethics adds binding provisions governing members' use of AI and technology.
UK Treasury backs financial-services AI adoption planHM Treasury accepts an industry AI adoption plan, signalling FCA and PRA workstreams on agentic finance and AI advice.
FRC finds AI in UK corporate reporting stays human-ledThe Financial Reporting Council research finds AI use rising but cautious, with reporting still human-led.
Bank of England names AI a systemic stability riskThe Bank of England's July 2026 Financial Stability Report names AI a systemic risk and signals bespoke rules for agentic AI.
High Court warns CPS on AI citesFabricated AI citations draw a judicial warning.
UK statutory ICO AI code of practiceA statutory duty requires the ICO to write an AI and automated-decision code, with a children's-data element.
High Court Rebukes CPS Over AI Fake CasesThe High Court rebuked the CPS after two non-existent, AI-linked cases reached it in Romanian extradition appeals.
ASA: disclose AI in adsThe ASA expects AI use in advertising to be disclosed and is monitoring compliance under the UK ad codes.
Ayinde: AI-faked cites as contemptThe Ayinde ruling holds that AI-fabricated citations submitted to court can amount to contempt.
BSB AI rules for barristersThe Bar Standards Board sets conduct expectations for barristers using AI in their practice.
DUAA automated-decision regimeThe Data (Use and Access) Act automated decision-making regime is now in force.
New data-complaints dutyOrganisations must operate a formal data-complaints procedure under the DUAA.
UK CMA: Publishers Can Opt Out of Google AI OverviewsThe CMA ordered Google to give publishers controls to keep content out of AI Overviews.
FCA Mills review on AI accountabilityThe FCA Mills review confirms senior-manager accountability is not diluted by the use of AI.
SM&CR review and AIThe FCA and PRA SM&CR review adds no new AI role and keeps existing senior-manager liability.
ICO ADM and profiling guidanceICO guidance on automated decisions and profiling targets recruitment and hiring.
Make Work Pay: workplace monitoring technologiesThe UK is consulting until 30 September 2026 on transparency for technologies that monitor, manage or make decisions about workers.
UKJT Legal Statement on liability for AI harmsThe UKJT draft says a professional can be negligent for misusing AI and for failing to use it where a competent peer would have.
ICO Clearview jurisdiction winA ruling extends ICO reach over foreign facial-recognition AI processing UK data.
MHRA AI-Airlock sandboxThe MHRA expands its AI-Airlock sandbox for AI used as a medical device.
Ofcom: chatbots under the OSAOfcom signals that AI chatbots can fall within Online Safety Act duties.
Getty v. Stability AI: Trademark Risk in AI OutputThe England and Wales High Court found trademark infringement where AI output reproduced Getty watermarks, and Getty won permission to appeal.
UK drops broad AI text-and-data-mining copyright planUK DSIT abandoned its broad text-and-data-mining opt-out copyright proposal after industry and rights-holder pushback.
UK launches advisory AI Growth Lab for regulated sectorsThe UK launched an advisory AI Growth Lab to test AI use cases across regulated sectors through a sandbox model.

Switzerland

FINMA sets AI governance expectations for Swiss financeFINMA Guidance 08/2024 outlines governance, accountability, and risk expectations for AI use across Swiss financial institutions.

Austria

Austria publishes Article 77 bodies but notifies no market surveillance authorityAustria reached AI Act general application on 2 August 2026 having published its Article 77 fundamental-rights bodies, while no Article 70 market surveillance authority or notifying authority has been notified.

Malta

Malta designates the MDIA as lead market surveillance authorityLegal Notice 226 of 2025 makes the MDIA lead market surveillance authority, single point of contact and sandbox authority; Legal Notice 227 of 2025 adds the IDPC for law enforcement AI.

Croatia

Croatia schedules its AI Act implementing law in the 2026 alignment planThe alignment plan in Narodne novine 26/2026 schedules the national AI Act implementing law. No implementing law was identified as enacted in the sources reviewed.

Belgium

Belgium publishes an ICPEN sweep on undisclosed AI influencer contentFPS Economy coordinated a 20-authority sweep and reported that 69 percent of influencers using AI-generated or AI-edited images did not systematically disclose it. Enforcement findings, not a new duty.

Slovakia

Slovakia's AI Act implementing bill is still a draftDraft act LP/2026/17 was withdrawn from the tripartite council agenda in March 2026 and had not been submitted to parliament by the AI Act general application date.

Iceland

Iceland says no AI Act bill until EEA incorporationA three-ministry working group on deepfakes was announced on 28 May 2026, with official confirmation that no implementing bill will be tabled until the Regulation is taken into the EEA Agreement.

Ukraine

Ukraine opens drafting of an EU-aligned AI lawThe Ministry of Digital Transformation convened the first meeting of its working group on the legal regulation of AI on 15 June 2026. A drafting step, not a binding rule.

Bulgaria

Bulgaria schedules its AI Act implementing law and authority designationCouncil of Ministers Decision No. 577 of 29 July 2026 adopts the legislative programme scheduling the national AI Act implementing law and the designation of competent authorities.

Albania

Albania publishes a draft AI law transposing the EU AI ActAKSHI published a draft law on artificial intelligence in the public consultation register, transposing the EU AI Act ahead of accession. A draft, not law.

International

IMO starts voluntary global code phase for autonomous shipsThe IMO opens the voluntary phase of its MASS Code, a global framework for autonomous and AI-assisted ships.
FPSB issues AI guidance for CFP financial plannersFPSB issues global AI guidance for CFP professionals on responsible use in financial planning.
FSB consults on responsible AI adoption in financeThe FSB consultation on sound practices for responsible AI adoption in finance closes for comment on July 22, 2026.
IAIS flags AI cyber and underwriting risk themesThe IAIS mid-year GIMAR flagged AI cyber exposure and AI-driven underwriting as emerging insurance risk themes.
RICS AI standard applies to members worldwideThe RICS professional standard on AI in surveying and valuation now applies to its members worldwide.
IOSCO issues AI supervisory toolkit for marketsIOSCO published an AI supervisory toolkit to help capital-markets regulators oversee AI use by firms.