AI Governance, 24 July 2026 - Nine Days

Two big things happened while the rest of us were pretending it was summer.

The GPAI Code of Practice signatory list went public. Meta is not on it. Google, OpenAI, Anthropic, Microsoft, Mistral and Amazon are. That single fact will shape enterprise AI procurement for the next six months.

And the 2 August 2026 clock is now inside single digits. Nine days. Article 50 transparency obligations apply to every provider and every deployer of GenAI in the EU market. This is not a drill, it is not deferred, and if your organisation touches EU users at any point in the value chain, someone should be able to answer three specific questions by next Friday.

I will get to those questions.

🇪🇺 The signatory story: Meta is out, the rest are in

• GPAI Code of Practice signatory list is live. Google, OpenAI, Anthropic, Microsoft, Mistral AI and Amazon signed all three chapters (Transparency, Copyright, Safety and Security). xAI signed the Safety and Security chapter only. Meta declined to sign, citing that the Code "goes beyond the AI Act" on dataset documentation and copyright filters. Legally, non-signing is not non-compliance. Practically, if you are a European enterprise choosing a foundation model provider this quarter, the Code signature is now the cleanest external signal of AI Office alignment you have. Expect procurement questionnaires to add a "signatory of GPAI Code of Practice" column by mid-August. Read

• Why this matters beyond procurement. GPAI providers who sign get a presumption of conformity route on Chapter V obligations. Non-signers have to demonstrate compliance through "alternative adequate means", which is a legal phrase that will be redefined by whoever gets audited first. If your legal team is planning to rely on Meta's Llama models for GenAI in the EU, factor in that Meta has explicitly walked away from the AI Office's soft-law path. That is a defensible choice. It is also a more expensive one to document.

🇪🇺 The deadline three days out: Transparency Code signatory window closes 27 July

• Code of Practice on transparency of AI-generated content: signing window closes Sunday 27 July 2026, 18:00 CEST. This is a different Code from the GPAI one above. It sits under Article 50(2) and covers deployer and provider obligations for AI-generated content labelling and watermarking. If your organisation wants to be on the initial list published before 2 August, the signature form has to be in the AI Office inbox by Sunday evening Brussels time. Signing is voluntary but confers a presumption of compliance path. Not signing is legal, but every Article 50(2) audit conversation for the next twelve months will start with "and you did not sign the Code because?" Read

🇪🇺 The Omnibus is entering into force this month

• Digital Omnibus on AI: Parliament passed 16 June, Council passed 29 June, Official Journal publication expected within days. Enters into force on the third day after publication. When it does:
• Standalone high-risk AI (Annex III) application deferred to 2 December 2027.
• Embedded high-risk AI (Annex I) application deferred to 2 August 2028.
• New Article 5 prohibition on AI-generated non-consensual intimate imagery and CSAM enters application December 2026.

If you have a board update landing this week, the accurate headline is: "The 2 August 2026 date now covers transparency and general-purpose AI only. High-risk obligations are deferred by 16 to 24 months. The compliance runway is longer, not shorter." Read

🇪🇺 What actually applies on 2 August 2026

• Article 50 transparency: chatbot disclosure. If you deploy an AI system that interacts with a natural person, that person must be told they are talking to an AI, unless it is obvious from context. Applies to every customer-facing chatbot, voice agent, and support system.
• Article 50 transparency: GenAI watermarking (providers). Providers of AI systems generating synthetic content must mark outputs as AI-generated in a machine-readable format. New systems only need to comply from 2 August. Systems already on the market before 2 August get until 2 December 2026.
• Article 50 transparency: deepfake and generated text labelling (deployers). Deployers must label deepfakes as artificially generated. For AI-generated text on matters of public interest, deployers must disclose unless the content underwent human review with editorial responsibility.
• General-Purpose AI obligations (Chapter V). Providers of GPAI models must publish training data summaries, respect EU copyright law, and provide downstream documentation. Systemic-risk models get additional obligations. This is where the GPAI Code of Practice signature becomes the practical compliance route.
• Governance and enforcement structures. AI Office and national authorities operational. AI Board convenes.

⚠️ Watchlist

• Transparency Code signatory window closes Sunday 27 July 2026, 18:00 CEST. 3 days.
• Article 50 transparency obligations apply 2 August 2026. 9 days.
• GPAI Chapter V obligations apply 2 August 2026. 9 days.
• Watermarking grace period for legacy GenAI systems ends 2 December 2026.
• Non-consensual sexual content and CSAM prohibition enters application December 2026 (via Omnibus, once published in OJ).
• Digital Omnibus on AI: Official Journal publication imminent, enters into force third day after publication.
• High-risk standalone (Annex III) now applies 2 December 2027 (via Omnibus).
• High-risk embedded (Annex I) now applies 2 August 2028 (via Omnibus).

The three questions to answer before next Friday

Before 2 August lands, whoever owns AI governance in your organisation should be able to answer these on one page:

1. Chatbot disclosure: what customer-facing AI system in the EU currently does NOT tell users it is an AI? If the answer is "none", get evidence. If the answer is "we are not sure", that is the pre-2 August priority. 2. GenAI outputs: are your organisation's AI-generated images, video, audio and synthetic media marked in a machine-readable format? For new systems, this is a 2 August obligation. For legacy, you have until 2 December but the plan needs to exist now. 3. Foundation model choice: is the model you rely on in production a signatory to the GPAI Code of Practice, or have you documented the "alternative adequate means" you are using instead? Meta being off the list means every organisation running Llama-based GenAI in production has homework this quarter.

If you cannot answer all three, next week is when you find out.

---

Not on the regular Monday cadence this week - the signatory news moved and the countdown is short. Back on Mondays from 28 July. If you are new here, the 13 July weekly has the fuller Omnibus breakdown.