AI Governance Weekly, 27 July 2026 - Six Days and a Deadline Tonight

Two things you need on your desk before lunchtime.

One: the transparency Code of Practice signing window closes at 18:00 CEST today. That is roughly six hours from when this post goes live. If your organisation was going to sign to make the initial list published before 2 August, this is the last window.

Two: 2 August is six days out. From Sunday, Article 50 transparency obligations apply, GPAI Chapter V applies, and the AI Office plus national competent authorities (17 already appointed) have enforcement powers. Fines for Article 50 non-compliance sit at €15 million or 3% of global turnover, whichever is higher. That is a real number for a real deadline.

Let me get into what actually moved this week.

🇪🇺 The deadline tonight: transparency Code signing closes 18:00 CEST

• Signing window for the Code of Practice on transparency of AI-generated content closes today, Monday 27 July 2026, at 18:00 CEST. Sign to be on the initial published signatory list. Signing gives you the presumption of compliance path on Article 50(2). Not signing is legal, but every audit conversation for the next twelve months will start with "and why did you not sign?" To sign, download the form, complete it, email it to `[email protected]`. If this is not already on someone's screen in your organisation, get it there today. Read

🇪🇺 The Omnibus was signed on 8 July. Publication in OJ imminent.

• Digital Omnibus on AI was signed by the Presidents of the European Parliament and Council on 8 July 2026. Publication in the Official Journal is the last remaining step, and it enters into force on the third day after publication. Once live:
• Standalone high-risk AI (Annex III): application deferred to 2 December 2027.
• Embedded high-risk AI (Annex I): application deferred to 2 August 2028.
• New Article 5 prohibition on AI-generated non-consensual intimate imagery and CSAM: applies from December 2026.

This changes nothing about 2 August, but it changes almost everything about the eighteen months after it. Board-level narrative correction: the "high-risk cliff" people were bracing for in August is now a runway. Use it to build compliance properly, not to defer it. Read

🇪🇺 What actually applies on 2 August 2026

• Article 50 transparency obligations. Chatbot disclosure to end users, GenAI watermarking by providers, deepfake labelling by deployers, disclosure of AI-generated text on matters of public interest. Legacy GenAI systems already on the market get a grace period on watermarking until 2 December 2026. New deployments: no grace. Fines up to €15M or 3% of worldwide turnover.
• GPAI Chapter V obligations. Training data summaries, EU copyright compliance, downstream documentation, systemic-risk model obligations for the largest models. The GPAI Code of Practice signature (separate from the transparency Code) is the practical route to a presumption of conformity here.
• Governance structures. AI Office active. National competent authorities appointed in 17 member states so far. AI Board convenes.
• Enforcement powers. The Commission and national regulators can open cases from 2 August onwards. Expect the first Article 50 enforcement action within 90 days.

🇪🇺 GPAI signatory list: Meta still absent

• Recap for anyone catching up: the GPAI Code of Practice signatory list is public. Google, OpenAI, Anthropic, Microsoft, Mistral and Amazon signed. xAI signed the Safety and Security chapter only. Meta declined. If your production stack relies on Llama, put a "document alternative adequate means" workstream on the roadmap this quarter. Read

⚠️ Watchlist

• Transparency Code signatory window closes TODAY 27 July 2026, 18:00 CEST.
• Article 50 transparency obligations apply 2 August 2026. 6 days.
• GPAI Chapter V obligations apply 2 August 2026. 6 days.
• National competent authority appointments ongoing (17 done, 10 pending).
• Watermarking grace period for legacy GenAI systems ends 2 December 2026.
• Non-consensual sexual content and CSAM prohibition enters application December 2026 (via Omnibus, effective on OJ publication + 3 days).
• Digital Omnibus Official Journal publication imminent following 8 July signing.
• High-risk standalone (Annex III) now applies 2 December 2027.
• High-risk embedded (Annex I) now applies 2 August 2028.

Your Monday morning triage

Three actions, in this order, before end of day:

1. Sign or document the decision not to sign the transparency Code by 18:00 CEST. Six hours. If it is not a "yes" today, it needs to be a "no, and here is why" on file. 2. Confirm chatbot disclosure is live everywhere you serve EU users. Every customer-facing AI system must tell users they are talking to an AI unless it is obvious. If you cannot list the systems, that is the priority. Six days to fix it. 3. Reset the board narrative on 2 August. For most organisations, 2 August is transparency and GPAI. High-risk is deferred. Get this into whatever briefings, letters or vendor comms are going out this week. The wrong deadline in the wrong document is its own problem.

---

Weekly cadence, Mondays. Next post: Monday 3 August, one day after enforcement starts. If you want the fuller Omnibus breakdown, see the 13 July weekly. For the signatory list backstory, see 24 July.