AI Regulation Tracker / Regional hub

Europe AI Regulation Tracker

The EU AI Act duties and the national laws and regulators across Europe that change what a professional must do, organized by jurisdiction. We update this as new rules land.

Maintained by The Leveraged Years Regulatory Research · Last updated August 25, 2026

European Union

Ofcom Opens NCII Hash Matching Enforcement CaseOfcom moved from publishing measures to opening an enforcement programme against them, three weeks before those measures take effect, and named the sectors it will look at first.
UK Sets the Date the ICO Office EndsSections 117(4)(a), 118 and 119 of the Data (Use and Access) Act 2025 were given a commencement date.
UK Issues an AI Risk Toolkit for GovernmentA government AI risk method is now published in one place: a guide, a set of risk identification questions across nine categories, a workbook and a risk monitoring dashboard, aligned to the Orange Book risk man
Hamburg DPA Reports on Ray-Ban Meta GlassesA German supervisory authority put a technical teardown of the Ray-Ban Meta Wayfarer (Gen 1) and a full legal assessment on the public record, and said what it thinks the law permits.
Estonia's AKI Circular on AI Apps in SchoolsThe inspectorate has put in one document what it expects a school to establish before an AI-enabled application is adopted, from processor agreements and vendor training settings to human oversight and risk ass
BfDI Asks Berlin to Legislate Health Data AIA federal supervisory authority put a request for AI-specific health data legislation on the record, about seven weeks before an opt-out research extraction from the electronic patient record is stated to begin
Ukraine: AI Gambling Duties Bind Agencies, Not FirmsOrder 855-r of 26 August 2026 approves a 2027 to 2029 plan whose two AI tasks, player risk-tiering and detection of hidden casino advertising, are assigned to state agencies. Clause 3 binds ministries and state institutions; clause 4 only recommends that private firms take part.
Solicitors Regulation Authority, Warning Notice: Misuse of AI, 17 August 2026Published and operative as guidance. It creates no new rule, but the SRA says it will have regard to it when exercising its regulatory functions and that failing to have proper regard risks disciplinary action.
Northern Ireland's Draft Artificial Intelligence Strategy, consultation by The Executive Office, open 12 AugusNot binding. This is an open consultation on a draft strategy. Neither the consultation nor the strategy it would produce creates a legal obligation. Responses received after the closing dat
Legal services advisory AI Growth Lab: overview, published by the Department for Business, Innovation, ScienceNot binding, and not a safe harbour. This is a voluntary advisory sandbox. The overview states plainly that participation does not provide regulatory approval, endorsement or exemptions from
Public consultation on the European Commission proposal for a Cloud and AI Development Act (CADA), Department Not binding on anyone. A consultation opened by the Department of Enterprise, Tourism and Employment to build an evidence base on a European Commission proposal that is itself still a propos
Growing up in the online world: government response, CP 1643, ISBN 978-1-5286-6739-5, Department for Science, A policy document, not law. The response states commitments; the department says detailed definitions of which chatbots fall in scope will be set out in regulations in due course.
Appointment of the Board of Oifig IS na hEireann (AI Office of Ireland) under the Regulation of Artificial IntAn appointment, not a rule. It creates no obligation on any provider or deployer, but it completes the governance layer of the body that coordinates Ireland's EU AI Act implementation.
Ustawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji, Dz.U. 2026 poz. 1003Binding statute. Signed by President K. Nawrocki, promulgated 27 July 2026 as Dz.U. 2026 poz. 1003, in force 14 days later. Parts of it are staged three months out.
Garante per la protezione dei dati personali, provvedimento n. 577 del 23 luglio 2026, doc. web 10281021Binding measure, in force. A prohibition on further processing under Article 58(2)(f) GDPR plus a formal warning under Article 58(2)(b). No fine was imposed.
Landgericht Muenchen I, 42. Zivilkammer, Urteil vom 31.07.2026, Az. 42 O 763/25 (GEMA v Suno)A first instance judgment, and expressly not final. The court's own press release states that the judgment is not legally binding, which means an appeal remains open.
Bafin press release of 29 July 2026 on the Gesetz zur Durchfuehrung der KI-Verordnung, including the KI-MarktuBinding. The implementing act entered into force on 29 July 2026 and BaFin is now the market surveillance authority for AI systems that stand in direct connection with a regulated financial
Autoriteit Persoonsgegevens news item De FRIA voor AI-systemen komt eraan: bereid u voor, with the publicationThe guidance and the pilot are not binding. The FRIA obligation itself is, and it starts in December 2027; participation in the pilot is voluntary and the AP states explicitly that it is not
CNPD Plano Plurianual de Atividades 2027-2029, Relatorio da Consulta Publica, and Plano de Atividades para 202Not binding on anyone. This is the CNPD's own multiannual activity plan for 2027-2029 plus its annual plan for 2027, approved after a public consultation. It creates no obligations for contr
CNIL and CIANum note exploratoire, IA agentique et protection des donnees personnelles: equation a inconnues mNot binding. This is an exploratory note co-written by the CNIL and the CIANum. It states positions and identifies problems; it creates no obligation and announces no enforcement position.
ACPR, L'equite algorithmique dans le secteur financier, document de reflexion, July 2026, plus consultation quNot binding. This is a discussion paper issued for public consultation. The ACPR states in the paper itself that it does not express an official ACPR position.
Ticari Reklam ve Haksiz Ticari Uygulamalar Yonetmeliginde Degisiklik Yapilmasina Dair Yonetmelik, Resmi GazeteBinding. This is a published regulation, not guidance. It was promulgated in the Official Gazette on 1 July 2026 and article 15 sets entry into force on 1 August 2026.
UODO, wystapienie DPNT.0623.18.2026 to the Minister of Family, Labour and Social Policy, 16 July 2026Not binding. This is a wystapienie, a formal letter from the President of UODO to a minister asking that legislative work begin. It creates no new obligation and starts no proceeding.
UODO, Listy pytan inicjalnych: Ochrona danych osobowych w kontekscie systemow sztucznej inteligencji, 6 AugustNot binding. UODO states the questions are not a binding interpretation of the provisions and do not determine GDPR compliance, and that the answers do not have to be presented to the superv
Ministerstwo Cyfryzacji announcement, Piaskownice regulacyjne AI, 10 August 2026This is a ministry announcement describing a mechanism created by the AI systems act signed by the President. The announcement itself binds nobody; it explains what the statute sets up. No c
O peri tis Technitis Noimosynis Nomos tou 2026 (draft Artificial Intelligence Law of 2026), public consultatioA draft bill in public consultation. It binds nobody. Comments are open on the e-Consultation platform until 16 September 2026 and the text can change before anything goes to the House.
O peri Rythmiseos Ilektronikon Epikoinonion kai Tachydromikon Ypiresion (Tropopoiitikos) Nomos tou 2026, draftA draft amending bill in open public consultation. It binds nobody. Comments close 16 September 2026 at 23:50 on the e-Consultation platform.
MFSA Circular, Frontier Artificial Intelligence Models and the Evolving Cyber-Threat Landscape, 5 August 2026A circular, not a rule. The Authority states it is not introducing a separate set of supervisory expectations specifically addressing frontier AI models. It applies to all Licence Holders; i
CTU press release of 31 July 2026 on the Article 50 AI Act transparency rulesA press release, not an instrument. It creates no obligation of its own and binds nobody. The obligations it describes come from Article 50 of the AI Act, which the regulator says takes effe
MIRRI SR press release of 13 August 2026 on the reworked draft Slovak act on artificial intelligenceNot law, and not binding on anyone. This is a ministry press release about a bill that has just been reworked and sent onward in the legislative process. It still has to clear the Legislativ
Government announcement of 7 August 2026 on the launch of the mihivatal.gov.hu websiteAn announcement of a website, not an instrument. It binds nobody and changes no obligation. What it does is give members of the public a named government address for AI grievances.
Draft Law on the Implementation of the European Union Artificial Intelligence Act, project No. XVP-1564Not law. A draft law that has only passed the presentation stage in the Seimas and returns to the plenary in the autumn session.
TTJA guidance page Tehisintellektisusteemid (Artificial intelligence systems), Estonian Consumer Protection anGuidance on an authority's website. It binds nobody, creates no new obligation, and describes TTJA's supervisory role in the future tense throughout.
ANCOM press release, Regulamentul privind inteligenta artificiala in Romania: stadiul actual al cadrului de imA press release, not an instrument. It binds nobody. Its central factual claim is that Romanian authorities cannot verify or sanction breaches until a national law, still in drafting, enters
Avukatlar Icin Yapay Zeka Kullanimi Tavsiye Rehberi and Yapay Zeka ve Avukatlik Calistayi Sonuc Raporu, TurkiyA recommendation guide and a workshop report from a professional body. Neither is a disciplinary rule, and the announcement describes them as recommendations shared with the profession and t
Law of the Republic of Azerbaijan No. 387-VIIQD of 21 April 2026 amending the Criminal Code, the Criminal ProcBinding. This is an adopted law signed by the President, not a draft or a consultation. The e-qanun record carries the status Quvvededir, meaning in force.
European Union (Artificial Intelligence) (Designation) (Amendment) Regulations 2026, S.I. No. 405 of 2026Binding. This is a statutory instrument made under section 3 of the European Communities Act 1972, signed and sealed, with notice of its making published in Iris Oifigiuil. It amends S.I. No
Practice Direction CA16, Practice Direction on the responsible use of Generative Artificial Intelligence in CoBinding on practice before the Court of Appeal. Ms Justice Caroline Costello issued it as President under the general authority of the office, the Court's inherent power to regulate its own
AI Omnibus enters into force and fixes the amended calendarRegulation (EU) 2026/1744 is binding from 27 July 2026, but Annex III high-risk duties apply from 2 December 2027 and Annex I from 2 August 2028.
EASA proposes Level 3 AI certification guidance for aviationEASA's AI concept paper issue 3 proposes Level 3 machine-autonomy certification guidance for aviation.
ESMA statement on AI for MiFID investment firmsESMA's statement sets expectations for how MiFID investment firms use AI while keeping governance and client-protection duties intact.
EU supervisors widen AI cyber duty via DORAThe EBA, EIOPA and ESMA jointly backed the ESRB frontier-AI cyber warning, making it a DORA supervisory expectation for banks, insurers and investment firms.
MDCG guidance on AI medical devices and the AI ActMDCG 2025-6 guidance explains how AI medical device rules interact with the EU AI Act.
Serious-incident reporting clockReport serious incidents in 15 days, 10 for a death, 2 for critical-infrastructure disruption.
Software and AI as a productStrict no-fault liability for defective software and AI, from December 9.
Article 5 intimate-image banA new ban on AI that generates non-consensual intimate imagery, effective December 2.
Article 50 transparencyMark AI-generated content and disclose deepfakes and chatbots, from August 2.
Omnibus high-risk delayHow the simplification package retimes high-risk duties and penalties.
Article 4 AI-literacy dutyA duty to ensure staff have a sufficient level of AI literacy.
EU AI Act Article 50 content labelsMark and disclose AI-generated content from August 2 or risk fines up to 15 million euro or 3 percent of turnover.
EU AI Office gains GPAI enforcementFrom August 2 the Commission can compel documents, evaluate GPAI models, order withdrawal and fine providers.
EU Digital Omnibus defers high-risk AIHigh-risk AI Act duties are deferred to December 2027 and August 2028, and AI nudifiers and CSAM are banned, pending publication.
EDPB web-scraping AI guidelinesNew guidelines confirm the GDPR applies to web scraping for AI even on public data, open to consultation to October 30.
EDPB tightens the anonymisation testA three-part test tightens when AI data stays outside the GDPR, open to consultation to October 30.
ESRB warns AI is a systemic cyber risk to financeThe ESRB warned that frontier AI models pose a systemic cyber risk to EU finance, with the EBA, EIOPA and ESMA concurring under DORA.
ECB: banks must file AI cyber plans by Oct 31The ECB told significant euro area banks to file AI cyber-resilience action plans with their supervisory teams by October 31, 2026 under DORA.
Council of Europe AI treatyThe first binding international AI treaty advances toward signature and ratification across Council of Europe states.
Article 50 reaches US law firmsArticle 50 transparency duties reach non-EU firms, including US law firms serving EU clients, from August 2, 2026.
EU cybersecurity and AI planThe EU cybersecurity action plan folds AI systems into critical-infrastructure and resilience expectations.
EU-Mercosur data and AI termsThe interim EU-Mercosur deal turns data and AI compliance into market-access conditions.
EU AI Office publishes non-binding frontier AI reportThe EU AI Office published a non-binding expert forum report on frontier AI risk and oversight direction.

Germany

Germany splits AI Act supervision across BaFin and the LaenderThe implementing act, BGBl. 2026 I Nr. 223, sends financial entities to BaFin, some Annex III categories to a dedicated chamber and Land bodies to the Laender.
Munich injunction treats Google AI output as its own contentA Munich court injunction treats Google's AI output as its own content, making it a direct infringer.
KI-MIG names the enforcerThe Bundesnetzagentur would be Germany's lead AI market-surveillance authority.

Spain

Galicia's regional audit body adopts binding internal AI rules for its own staffBinds only the Consejo de Cuentas de Galicia and its own personnel. In force 21 August 2026. AI output is not sufficient audit evidence on its own, and using AI to profile people is prohibited.
AESIA and a fine scheduleA draft law with fines up to 35 million euros, enforced by AESIA.
Spain AEPD fines unlawful AI deepfake image processingSpain's AEPD fined the unlawful processing of personal data behind AI deepfake image generation.

Italy

Italy would seat the Garante as AI Act market surveillance authorityA draft decree would designate the data protection authority as AI Act market surveillance authority for the Article 74(8) categories, the opposite institutional choice from Germany's. The decree is a draft and the Garante's workplace ask is an observation, not a condition.
Rome court annuls OpenAI Italian fine on jurisdictionA Rome court annuls the Garante's OpenAI fine on jurisdictional grounds, reshaping EU enforcement.
Italy AGCM opens Microsoft 365 Copilot AI bundling probeItaly's competition authority probes whether Microsoft 365's Copilot AI bundling and default price rise misled consumers.
Law 132/2025 decreesWorkplace-AI notice, a health-data notification duty, and liability rules advancing.
Italy fines Character.AI over minorsThe Garante fined Character.AI's owner and ordered working age verification and private-by-default minor profiles within 120 days.

France

France Studies a Bill That Would Presume AI Firms Used Protected WorksFrance's Conseil d'Etat found no constitutional bar to a bill presuming generative AI providers used copyrighted works.
APIG refers Google AI Overviews to the AutoriteThe press alliance asks the regulator to enforce commitments it says run until 2027 against a later AI feature. No decision yet.
CNIL on AI as personal dataA trained model may itself be personal data under the GDPR.
France moves to name CNIL a lead AI Act regulatorFrance's DDADUE bill moves to name CNIL among the lead AI Act market-surveillance authorities.

Ireland

High Court rules on GenAI court documentsPractice Direction HC 142 comes into operation 1 September 2026 and requires independent verification of generative-AI-assisted court material, with specific disclosure safeguards.
AI Office is now statutoryThe 2026 Act establishes the AI Office as an independent statutory coordinating authority for EU AI Act implementation. It does not add duties beyond the EU Regulation.
EU: ChatGPT Designated a Very Large Search EngineThe Commission designated ChatGPT a VLOSE under the DSA on 31 August 2026, on the reasoning that a hybrid service answering queries partly by searching the web qualifies as a search engine. Its own texts give two different compliance deadlines and the decision is unpublished.
Ireland AI Bill: Enforcers and Fines Up to 7%Ireland's AI Bill names the Data Protection Commission, Central Bank and CCPC as market-surveillance authorities, with fines up to 7% of global turnover.

Poland

Poland publishes its AI systems act and designates KRiBSIDziennik Ustaw 2026 poz. 1003 makes the act law and Article 5(1) names KRiBSI as the Article 70(1) market surveillance authority.
The KRiBSI watchdogA new AI oversight body and EU single point of contact.
Poland AI Act clears ParliamentThe AI systems act cleared the Sejm and went to the President, with KRiBSI as enforcer; not yet signed.

Netherlands

Decentralized oversightEight sectoral supervisors coordinated by the data authority and the RDI.
Dutch regulator: sign AI transparency code by 22 JulThe Dutch AP urges signing the EU AI transparency Code before the July 22, 2026 first-signatory cut-off, with Article 50 duties applying August 2.
Dutch interim order: X must stop Grok nudify and CSAM imagesA Dutch court issued an interim order requiring X to stop Grok from generating nudify and CSAM imagery.
Dutch appeals court upholds order to open X moderation dataA Dutch appeals court upheld an order requiring X to open automated moderation data under Article 15 access rights.

Nordics

Finland switches on supervisionNational AI Act supervision is live, with Traficom as the EU contact point.

Norway

Norway's KI-loven still described as forthcoming after the EU's August dateNorway takes the AI Act through the EEA Agreement, so it binds when the KI-loven takes effect. Nkom, the designated coordinating supervisory authority, still describes the law as on its way.
Norway: smart-glasses rules = same as a phone cameraNorway's Datatilsynet says smart-glasses filming follows phone-camera rules, and publishing recordings of people in public triggers the GDPR and consent.

Denmark

Denmark's AI sandbox reports set the barDenmark's Datatilsynet published AI sandbox final reports covering legal basis, controller roles, AI Act risk classification and prohibited-practice screening.

Sweden

Sweden IMY reprimands Securitas over AI driver camerasSweden's IMY reprimanded Securitas over AI-driven driver camera surveillance and the data-protection limits on monitoring workers.
EU sets AI web-scraping rules, IMY led the draftEDPB Guidelines 03/2026, led by Sweden's IMY, set legitimate-interest limits and sensitive-data filtering for AI scraping, open to consultation to October 30.
Sweden police live facial recognitionLive police facial recognition is in force under EU AI Act Article 5, with court authorization and narrow triggers.
Sweden picks PTS to police the AI ActSweden's inquiry SOU 2025:101 proposes a complementary AI Act law naming PTS lead market surveillance authority, with a sandbox and sanctions.

Greece

Greece names its AI Act enforcersA draft bill names the HDPA as market-surveillance authority and EETT as notifying authority.

United Kingdom

MHRA Draws the AI Scribe Device Line at the Claim, Not the TechMHRA guidance clarifies that transcription, summarising, coding and letter-drafting are not medical devices, while suggested diagnoses, autonomous ordering or diagnostic marketing claims make an AVT product a device, Class IIa where it allows direct diagnosis.
Court of Appeal treats AI witness preparation as prohibited coachingR v FGD holds that witness training is forbidden and that witnesses should be firmly discouraged from using AI to prepare evidence.
ICAEW adds binding AI ethics duties for its membersThe ICAEW Code of Ethics adds binding provisions governing members' use of AI and technology.
UK Treasury backs financial-services AI adoption planHM Treasury accepts an industry AI adoption plan, signalling FCA and PRA workstreams on agentic finance and AI advice.
FRC finds AI in UK corporate reporting stays human-ledThe Financial Reporting Council research finds AI use rising but cautious, with reporting still human-led.
Bank of England names AI a systemic stability riskThe Bank of England's July 2026 Financial Stability Report names AI a systemic risk and signals bespoke rules for agentic AI.
High Court warns CPS on AI citesFabricated AI citations draw a judicial warning.
UK statutory ICO AI code of practiceA statutory duty requires the ICO to write an AI and automated-decision code, with a children's-data element.
High Court Rebukes CPS Over AI Fake CasesThe High Court rebuked the CPS after two non-existent, AI-linked cases reached it in Romanian extradition appeals.
ASA: disclose AI in adsThe ASA expects AI use in advertising to be disclosed and is monitoring compliance under the UK ad codes.
Ayinde: AI-faked cites as contemptThe Ayinde ruling holds that AI-fabricated citations submitted to court can amount to contempt.
BSB AI rules for barristersThe Bar Standards Board sets conduct expectations for barristers using AI in their practice.
DUAA automated-decision regimeThe Data (Use and Access) Act automated decision-making regime is now in force.
New data-complaints dutyOrganisations must operate a formal data-complaints procedure under the DUAA.
UK CMA: Publishers Can Opt Out of Google AI OverviewsThe CMA ordered Google to give publishers controls to keep content out of AI Overviews.
FCA Mills review on AI accountabilityThe FCA Mills review confirms senior-manager accountability is not diluted by the use of AI.
SM&CR review and AIThe FCA and PRA SM&CR review adds no new AI role and keeps existing senior-manager liability.
ICO ADM and profiling guidanceICO guidance on automated decisions and profiling targets recruitment and hiring.
Make Work Pay: workplace monitoring technologiesThe UK is consulting until 30 September 2026 on transparency for technologies that monitor, manage or make decisions about workers.
UKJT Legal Statement on liability for AI harmsThe UKJT draft says a professional can be negligent for misusing AI and for failing to use it where a competent peer would have.
ICO Clearview jurisdiction winA ruling extends ICO reach over foreign facial-recognition AI processing UK data.
MHRA AI-Airlock sandboxThe MHRA expands its AI-Airlock sandbox for AI used as a medical device.
Ofcom: chatbots under the OSAOfcom signals that AI chatbots can fall within Online Safety Act duties.
Getty v. Stability AI: Trademark Risk in AI OutputThe England and Wales High Court found trademark infringement where AI output reproduced Getty watermarks, and Getty won permission to appeal.
UK drops broad AI text-and-data-mining copyright planUK DSIT abandoned its broad text-and-data-mining opt-out copyright proposal after industry and rights-holder pushback.
UK launches advisory AI Growth Lab for regulated sectorsThe UK launched an advisory AI Growth Lab to test AI use cases across regulated sectors through a sandbox model.

Switzerland

FINMA sets AI governance expectations for Swiss financeFINMA Guidance 08/2024 outlines governance, accountability, and risk expectations for AI use across Swiss financial institutions.

Austria

Austria publishes Article 77 bodies but notifies no market surveillance authorityAustria reached AI Act general application on 2 August 2026 having published its Article 77 fundamental-rights bodies, while no Article 70 market surveillance authority or notifying authority has been notified.

Malta

Malta designates the MDIA as lead market surveillance authorityLegal Notice 226 of 2025 makes the MDIA lead market surveillance authority, single point of contact and sandbox authority; Legal Notice 227 of 2025 adds the IDPC for law enforcement AI.

Croatia

Croatia schedules its AI Act implementing law in the 2026 alignment planThe alignment plan in Narodne novine 26/2026 schedules the national AI Act implementing law. No implementing law was identified as enacted in the sources reviewed.

Belgium

Belgium publishes an ICPEN sweep on undisclosed AI influencer contentFPS Economy coordinated a 20-authority sweep and reported that 69 percent of influencers using AI-generated or AI-edited images did not systematically disclose it. Enforcement findings, not a new duty.

Slovakia

Slovakia's AI Act implementing bill is still a draftDraft act LP/2026/17 was withdrawn from the tripartite council agenda in March 2026 and had not been submitted to parliament by the AI Act general application date.

Iceland

Iceland says no AI Act bill until EEA incorporationA three-ministry working group on deepfakes was announced on 28 May 2026, with official confirmation that no implementing bill will be tabled until the Regulation is taken into the EEA Agreement.

Ukraine

Ukraine opens drafting of an EU-aligned AI lawThe Ministry of Digital Transformation convened the first meeting of its working group on the legal regulation of AI on 15 June 2026. A drafting step, not a binding rule.

Bulgaria

Bulgaria schedules its AI Act implementing law and authority designationCouncil of Ministers Decision No. 577 of 29 July 2026 adopts the legislative programme scheduling the national AI Act implementing law and the designation of competent authorities.

Albania

Albania publishes a draft AI law transposing the EU AI ActAKSHI published a draft law on artificial intelligence in the public consultation register, transposing the EU AI Act ahead of accession. A draft, not law.

International

IMO starts voluntary global code phase for autonomous shipsThe IMO opens the voluntary phase of its MASS Code, a global framework for autonomous and AI-assisted ships.
FPSB issues AI guidance for CFP financial plannersFPSB issues global AI guidance for CFP professionals on responsible use in financial planning.
FSB consults on responsible AI adoption in financeThe FSB consultation on sound practices for responsible AI adoption in finance closes for comment on July 22, 2026.
IAIS flags AI cyber and underwriting risk themesThe IAIS mid-year GIMAR flagged AI cyber exposure and AI-driven underwriting as emerging insurance risk themes.
RICS AI standard applies to members worldwideThe RICS professional standard on AI in surveying and valuation now applies to its members worldwide.
IOSCO issues AI supervisory toolkit for marketsIOSCO published an AI supervisory toolkit to help capital-markets regulators oversee AI use by firms.

Recent Europe coverage

EU Can Demand Model Weights, and Your Logs OffRegulation (EU) 2026/1755 lets the Commission require access to GPAI source code, model weights and infrastructure, and to require logging be disabled.
EU Will Count Generative AI Use From 2027Regulation (EU) 2026/1864 adds ten mandatory generative AI variables to the EU household ICT survey for reference year 2027, including six on non-use.
CNIL Tool Traces Which Models Inherit Your DataThe CNIL updated Genmod, its demonstrator mapping open-weight model genealogy, to trace which derivative models may retain memorised personal data.
Tribunal Rejects AI Claim Against Expert ReportIn LR (Male VOTs) Albania CG the Upper Tribunal found no proper foundation for a cross-examination allegation that an expert report was AI-generated.
ICO Audits Five Forces on Police Facial RecognitionICO facial recognition outcomes report covers audits of five police forces, finds inconsistent compliance and sets must, should and could duties.
Court Doubts ChatGPT-Polished Witness EvidenceGodwin v Godwin: the court could not be sure witness statements were in the makers' own words after ChatGPT use, and treated the evidence cautiously.
Judge: AI Invented an Insolvency Rule in Firm LetterICC Judge Mullen found a Pinsent Masons letter quoted a non-existent Insolvency Rule produced with AI, and ordered the judgment sent to the SRA.
Upper Tribunal: A Recommender Has No Artistic PurposeUpper Tribunal held TikTok's recommender did not process data for the special purposes, dismissing its appeal against the ICO penalty.
High Court Rejects AI Excuse for Faked Court ExhibitLinden J referred Amar Lodhia to the Attorney General over falsified evidence, rejecting his claim that an AI tool generated a fabricated exhibit.
Greek Gazette Carries AI Thesis Rules With ExpulsionThree University of Crete doctoral rules in the Greek gazette set a closed list of permitted AI uses and make undisclosed use grounds for removal.
Bulgaria Ties AI Act Conformity to Transport IT BuildsBulgarian Ordinance H-7 makes Regulation 2024/1689 conformity a condition of building and running public transport IT. In force 31 August 2026.
Bank of Italy Sets 31 December AI Resilience DeadlineBanca d'Italia gave directly supervised banks, payment institutions and crypto firms until 31 December 2026 to file a board report and work plan.
Turkey Puts Its 2026-2030 AI Action Plan in ForcePresidential Circular 2026/9, signed 17 August 2026 and gazetted 18 August, directs all Turkish public bodies to implement the 2026-2030 AI Action Plan.
German Court on Exam Phones: AI Is Not the TestOVG NRW decided 6 A 392/25 on 24 August 2026. AI intensifies existing case law on exam deception; it is not the test, and it binds only the parties.
Dutch Rule: Say If AI Personalised Your PriceStb. 2026, 251 adds a BGfo duty to disclose personalised pricing by automated decision-making. In force 28 August 2026, enforced by the AFM.
Hungary Claims Audit Right Over a Grid AlgorithmDecree 8/2026 MEKH, dated 28 August 2026 and in force 30 August, lets the regulator audit MAVIR's hourly learning algorithm for reserve procurement.
Turkey Opens Own-Motion Probe of Grok and X.AIThe KVKK announcement of 11 February 2026 opened a re'sen inceleme into X and X.AI over Grok, citing suspected breaches of Law No. 6698.
Portugal Bans Emotion Detection in Ride-Hailing VideoLei 59/2026 of 25 August adds Artigo 19-A to Portugal TVDE law, in force 1 September 2026. The video prohibition carries no TVDE fine.
CCBE Issues GenAI Guide for EU LawyersNon-binding guidance. It creates no new obligation and does not amend any bar rule. It interprets how existing professional duties apply to GenAI use.
Czech draft AI Act law splits oversight among three regulatorsDraft in interministerial comment (meziresortni pripominkove rizeni); no Chamber of Deputies bill number assigned at the reference date.
Denmark drafts copyright-based deepfake likeness rightDraft in public consultation. Published 7 July 2025; consultation deadline 21 August 2025. Not enacted.
CJEU SCHUFA Ruling Reaches AI Credit ScoringBinding. A preliminary ruling of the CJEU authoritatively interprets the GDPR and binds every national court applying it. This is settled precedent, not a consultation or opinion.
EU Issues AI Act Article 50 GuidelinesThe guidelines are non-binding interpretive guidance. The Article 50 transparency obligations they explain are binding and apply from August 2, 2026. This entry is classed as an ACTION because it maps a binding duty with a hard effective date, not a mere...
EU Draft Guidelines Sort Which AI Systems Are High RiskNon-binding. These are draft guidelines reflecting the Commission's interpretation. They do not change the text of the AI Act and carry no penalty of their own, though they signal how classification is likely to be enforced.
EBA Maps AI Act to Credit ScoringThe letter is a non-binding supervisory communication and mapping input to future Commission Guidelines. It is a SIGNAL, not a rule. The AI Act obligations it maps are binding and apply from August 2, 2026.
EIOPA AI Governance Opinion for InsurersNon-binding. It is a supervisory Opinion, not a regulation or directive. EIOPA states it "does not set new requirements and does not alter the scope of either the AI Act or existing sectoral legislation." National supervisors are expected to take it into...
EMA Sets AI Expectations Across the Medicine LifecycleNon-binding. A reflection paper states the EMA's current thinking; it is not a regulation or a legally enforceable guideline. It signals the direction of future formal guidance and interacts with binding law such as the EU AI Act, GxP standards, and...
CNIL Names AI Recruitment a 2026 Control PriorityNon-binding signal. This is an annual inspection-priority announcement, not a statute, decision, or fine. It sets no new legal obligation. The underlying law being enforced is the GDPR and the French Data Protection Act (loi Informatique et Libertes).
French Top Court Backs CNIL Block On Video AI AnalysisBinding. This is a final ruling of the highest administrative court. It is not guidance or an opinion. It settles, as a matter of French administrative law, that the cited surveillance provision does not authorize automated algorithmic analysis of the footage.
BaFin Sets AI ICT Risk Expectations for Finance Under DORANon-binding. This is an orientation aid setting out supervisory expectations. It does not itself impose new legal obligations. The underlying DORA framework it interprets is binding EU law.
German Court Rules OpenAI Lyric Reproduction InfringesBinding as a first-instance judgment between the parties, but not final. OpenAI has announced an appeal to the Higher Regional Court of Munich, and the judgment may be reviewed on appeal.
OLG Hamburg, Kneschke v. LAION: the opt-out rulingNot final; further appeal (Revision) to the Bundesgerichtshof admitted (source: full judgment, Landesrecht Hamburg)
Hungary Act LXXV of 2025: Implementing the EU AI ActIn force. Designating authorities confirmed by Decree 344/2025: National Accreditation Authority (notifying) and the minister for enterprise development (market surveillance and single point of contact).
Central Bank of Ireland Names AI a Core Supervisory RiskNon-binding as a document. The Outlook sets supervisory priorities and expectations; it does not itself create new legal obligations. It reflects and points to binding law, including existing financial regulation and the EU AI Act, under which the Central...
Irish DPC Opens Grok Inquiry Over Sexualised AI ImagesSignal, not a ruling. This is the commencement of an inquiry. It determines whether X complied with the GDPR; it is not itself a finding of infringement, a corrective order, or a penalty. Any of those would come, if at all, at the end of the process.
Italy's Garante Orders DeepSeek to Limit Italian Data ProcessingUrgency order issued alongside a full investigation; further determinations reserved.
Italy Fines Replika Maker 5M EuroBinding enforcement. A final administrative fine of 5 million euro plus a compliance order, cited under GDPR Articles 5.1(a), 6, 12, 13, 5.1(c), 24 and 25.1. Subject to the controller's right of judicial appeal in Italy.
Latvia AI Centre Law creates supervised AI sandbox powersIn force (speka esoss), as amended by the law of 14 May 2026.
Lithuania Names RRT AI Act Market Authority and SPoCEnacted and in force. Verified against the Ministry competent authorities page (updated 23 July 2025) and the RRT AI regulation page.
Luxembourg Bill 8476 Would Name CNPD Default AI AuthorityPending bill, in committee (en commission). Not yet law.
Mexico Moves to Criminalize AI Deepfake ImpersonationNone yet. This is a dictamen approved at committee level in one chamber of the Mexican Congress. It expresses the text the Comisión de Justicia is sending forward, but it has no legal force. To become law it must be approved by the full Cámara de...
Mexico Copyright Law: Consent to Use a Voice in AIMexico amended its Federal Copyright Law to treat voice as part of a person's image and to require express prior written authorization, with remuneration, before that image or voice is used in any AI system. The change took effect May 15, 2026, and reaches...
Mexico New Data Law Adds AI Automated-Decision DutiesBinding. This is a federal statute in force, not guidance or a consultation. It replaced the prior 2010 LFPDPPP.
Yucatan Makes Misuse of AI Software a CrimeMost Latin American AI legislating happens at national level and stalls in committee. This one is a state penal code amendment that is already in force.
Dutch AP Fines Uber 825m Over Automated DeactivationAnnounced and binding on the addressee. The AP page states Uber has announced an objection (bezwaar).
Dutch DNB SAFEST AI Principles for FinanceNon-binding. The SAFEST paper is a discussion paper setting out DNB's preliminary view and supervisory expectations. It is not a regulation and creates no new statutory duty on its own. It sits alongside existing binding law such as the Financial...
Portugal names 14 AI fundamental-rights supervisorsRegulatory designation under a binding EU regulation. The Article 77 list is a published national designation. The Article 70 designation is not yet adopted in Portuguese law.
Puerto Rico Mandates Annual AI Security TrainingTraining mandates rarely make news. This one is worth reading because it is a rare example of a legislature putting AI competence into a statutory annual requirement rather than into a framework document.
Puerto Rico Extends Image Rights to Generative AIThis is a one-subsection amendment, and that is the interesting part. Puerto Rico did not build a new AI statute. It widened a definition that fifteen years of case law already hangs on.
Romania Proposes ANCOM as AI Act Market Watchdog & ContactProposed via the Government agenda note and reflected in ANCOM's own framework communication; not yet an adopted act, and national institutional and penalty rules still to be set in law.
Serbia's 2025-2030 AI strategy and its AI CouncilNon-binding framework. A planning document under Article 38(1) of the Law on the Planning System, not a statute creating obligations.
Slovenia's ZIUDHPUI: AI Act Implementation Law, ExplainedIn force.
Spain AEPD Fines Aena EUR 10.04M for DPIA Failure on BiometricsNot final. Aena has said it will appeal to the courts.
AEPD Reads GDPR Accuracy as Fitness for PurposePublished. Final text, 23 pages, Spanish only as far as we could find.
Spain's AEPD Sanctions University Biometric Exam ProctoringBinding enforcement decision. The AEPD sanctioned the university. The regulator's own text states the resolution can be appealed, so it is subject to review before the courts.
Switzerland Plans AI Rules Consultation Draft by End of 2026Announced plan and stated timeline. Not adopted, not in force.
Turkey's KVKK Bill Targets AI Deepfake ContentNon-Binding Framework
Turkey KVKK Issues Generative AI Data-Protection GuidanceNon-binding guidance. It interprets and signals how the KVKK will apply existing Law No. 6698 to generative AI. It does not create new binding obligations by itself, but the underlying law it applies is binding and enforceable.
Hungary 139/2026: Who Supervises the AI AuthorityGovernment decree in force 1 September 2026. It adds section 173/A to the decree on ministerial duties, assigning a minister supervision of the AI notifying and market surveillance authority. It does not create or name that authority and does not cite Regulation (EU) 2024/1689.
First AI Act Harmonised Standard Reaches Public EnquiryNon-binding draft. A standard in development, not a law and not yet a published harmonised standard. It does not yet confer a presumption of conformity with the AI Act.
UK Judiciary Refreshes AI Guidance for JudgesPublished and current. Updates the April 2025 guidance.
TCC Guide 2026 Adds an AI Section at Paragraph 1.6In force as the current edition; supersedes the October 2022 edition

Germany Puts AI Risk Into a Law Firm ExamThree clauses in an eight page vocational ordinance. What makes them worth reading is what the drafters did not put in the two sibling ordinances published the same day.