AI Governance Catch-up, 10 to 22 June 2026

I was off for two weeks. Here's the compressed version.

The good news: I have not missed any 2 August enforcement. The clock is still 41 days out. The real news: the regulatory machinery did not pause. The Code of Practice on AI-generated content finalised, OpenAI rolled the biggest enterprise deployment of its life into Samsung, and the high-risk classification consultation closes tomorrow, 23 June. If you've been waiting for a "I'll do it next week" moment to engage, this is the last one.

Let me get into it.

🇪🇺 The fortnight's biggest story: Code of Practice landed

• EU Code of Practice on marking and labelling AI-generated content was finalised on 10 June 2026. This is the operational compliance tool for Article 50(2). For providers, the Code recommends two mechanisms: digitally-signed metadata AND imperceptible watermarking. Fingerprinting/logging is optional with a registry database. For deployers, signatories commit to visible AI-marking icons (provided by the EU AI Office) on AI-generated content. Voluntary, but signing it gives you the cleanest route to "presumption of compliance" when Art. 50(2) applies on 2 August. If you build or deploy GenAI in the EU, this is the document you should already have circulating internally. Read

• EC announcement of the finalised Code (10 June). The Commission's press-corner version, useful if you want the official framing for a board paper. Read

🇪🇺 The deadline tomorrow

• High-risk AI classification consultation closes 23 June 2026, end of day Brussels time. Final 24 hours. If your business touches Annex III use cases (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice) and you have a view on how the Commission's 174-page draft guidelines should land, this is the last window. After tomorrow you're a rule-taker. Read

🇺🇸 US side: state laws compound, EO implementation rolls on

• Trump AI Executive Order remains in implementation phase. The 3 June order is now being operationalised through agency guidance, including FTC policy statement work and the DOJ AI Litigation Task Force. The cyber mandate keeps moving. If you sell into US federal procurement, your vendor risk register needs to reflect this as a live, not pending, regime.

• State-level AI law expansion continued. Colorado (in force 30 June), Texas TRAIGA (in force 1 January 2026), Connecticut SB 5, Louisiana privacy. The US "patchwork" is now the system, not a transition. Build to the highest common denominator and stop waiting for federal preemption.

🏢 Enterprise & Operating Model

• Samsung Electronics deploys ChatGPT Enterprise and Codex worldwide. Announced 21 June. One of OpenAI's largest enterprise rollouts to date. Worth noting on two levels: vendor scale (OpenAI is now embedded in a global manufacturing giant) and governance scale (Samsung's deployment will be a reference architecture every CTO gets shown by July). If you're negotiating an OpenAI Enterprise contract this quarter, the Samsung terms will be the comparator. Read

• OpenAI S-1 watch continues. No public version of the prospectus yet. Confidential review is the standard SEC pre-IPO path. Every governance professional should still have "read S-1 within 48 hours of filing" on their reaction list.

🧠 Voices worth 5 minutes

• Azhar, Exponential View #579: Product eats the AI company. Azhar's argument that the dominant AI players will be the ones that win on product surface, not model capability. Useful counter-frame for anyone whose AI strategy is "pick the best model." Read

⚠️ Watchlist (updated)

• High-risk classification consultation closes TOMORROW, 23 June 2026. Last 24 hours.
• Article 50 transparency obligations apply 2 August 2026. 41 days.
• High-risk AI obligations apply 2 August 2026 on the current calendar.
• Code of Practice on AI-generated content finalised 10 June. Move from watch to act.
• EU Omnibus formal adoption still pending. The provisional dates remain provisional.
• Trump AI Executive Order implementation phase underway, agency guidance rolling out.
• CNIL Privacy Research Day was 24 June 2026 (this Wednesday).
• OpenAI S-1 SEC review timeline: TBD.

What this means for the rest of the week

Two non-negotiables on your calendar:

1. Today/tomorrow: Submit a position on the high-risk classification consultation if you have one. Even a one-page comment is better than silence. 2. This week: Get the Code of Practice on someone's desk who can decide whether your organisation signs. Signing is the easy compliance path. Not signing is allowed but more work.

Then resume normal programming. Daily skim tomorrow, Friday deep-dive on Friday. I'll be back on the regular cadence.

---

Two weeks of governance compressed into one post. The 2 August clock is now 41 days, and the Code of Practice is the document that should sit on top of every other AI compliance artefact you're producing. See you tomorrow.