AI Governance Weekly, 13 July 2026

Quick update

This is a weekly Newletter now - every Monday. The daily version worked for a while, but this seems to work better. 

Now: 20 days to 2 August. Two things on your desk this week.

🇪🇺 The Omnibus is done. High-risk deadlines have moved.

• Council gave final green light to the AI Act simplification package on 29 June 2026. The European Parliament endorsed it on 16 June. Formal adoption and publication in the Official Journal are the last steps, expected before 2 August. This is the Omnibus moving from "provisional, watch this space" to "binding, plan around it." The two dates that changed:
• Standalone high-risk AI systems (Annex III): application deferred from 2 August 2026 to 2 December 2027.
• High-risk AI embedded in regulated products (Annex I): deferred to 2 August 2028.

If your 2026 board narrative was "high-risk hits us in August," update it. You have another 16 months on standalone, and just over two years on embedded. That is real breathing room, and it is also a real risk of complacency. Use it to build the compliance function properly, not to shelve it. Read

• What did NOT move: Article 50 transparency. 2 August 2026 still applies. Chatbot disclosure, GenAI watermarking for new systems, deepfake labelling by deployers. The one nuance worth knowing: systems already on the EU market before 2 August get a four-month grace period on the watermarking obligation, so the practical deadline for legacy GenAI is 2 December 2026. New systems and net-new deployments: 2 August, no grace. Read

🇪🇺 The deadline is nine days out: Code of Practice signatory list closes 22 July

• Code of Practice on transparency of AI-generated content: signing window closes 22 July 2026, 18:00 CEST. If your organisation wants to be on the initial published signatory list (the one that goes out before 2 August), the form has to be in the AI Office's inbox by then. To sign, download the signature form, complete it, and email it to `[email protected]`. Signing gets you the presumption of compliance path on Article 50(2) and, per the Commission, a lighter monitoring regime. Not signing is allowed. It is also more work and less predictable. Read

🇪🇺 Also live: high-risk classification consultation, second window

• Targeted consultation on the draft high-risk classification guidelines is open until 23 July 2026. If you thought this closed on 23 June, it did, in its first form, and the Commission reopened a targeted window for stakeholders on the revised draft. Same instruction as last month: if you touch any Annex III use case (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice), a one-page position from you is better than silence. Final guidelines by the end of 2026. Read

🇪🇺 New in the Omnibus you might have missed

• Non-consensual sexual and intimate content is being explicitly banned. The Omnibus adds a new prohibition covering AI that generates non-consensual sexual imagery of real people and CSAM. In force from December 2026. This is a prohibited practice, not a high-risk one, which means it sits alongside the Article 5 bans and carries the same top-tier penalty tier. Trust and safety teams should already be flagging this in policy language. Read

⚠️ Watchlist

• Code of Practice signatory list closes 22 July 2026, 18:00 CEST. 9 days.
• Article 50 transparency obligations apply 2 August 2026. 20 days.
• Watermarking grace period for legacy GenAI systems ends 2 December 2026.
• Non-consensual sexual content and CSAM prohibition enters application December 2026 (via Omnibus).
• High-risk standalone (Annex III) obligations now apply 2 December 2027 (via Omnibus).
• High-risk embedded (Annex I) obligations now apply 2 August 2028 (via Omnibus).
• High-risk classification guidelines targeted consultation closes 23 July 2026.
• Omnibus Official Journal publication expected before 2 August 2026.

What to do this week

Two calls to make:

1. Sign or decide not to sign the Code of Practice by 22 July. Do not let this drift into the last 48 hours. Whoever owns AI governance in your org should have the signed form or a documented decision not to sign, on file, this week. 2. Reset the internal narrative on 2 August. For most organisations, 2 August is now a transparency deadline, not a high-risk deadline. Get that clarified in whatever briefings, board papers, or vendor letters are going out this month. The wrong deadline in the wrong document creates its own problem later.

---

Series is weekly now. Next post: Monday 20 July. If you're new here, the 10 to 22 June catch-up is the best backdrop for where we are.