EU and UK advance AI rules as security tests expose autonomy risks

The EU’s Digital Omnibus on AI entered into force on 27 July 2026, making targeted changes to EU AI Act timelines, deepfake protections and compliance requirements. Article 50 transparency obligations still apply from 2 August 2026, and the European Commission issued final guidelines on disclosures for interactive AI systems, machine-readable marking of AI-generated content, and labelling for deepfakes and certain public interest text.

The EDPB opened consultation on 8 July 2026 on draft Guidelines 03/2026 covering web scraping for generative AI under the GDPR, including lawful basis, transparency, special category data and controller obligations. The UK also launched a legal services AI Growth Lab on 3 August 2026, giving law firms, LawTech companies, AI developers and public bodies up to nine months to work with regulators on legal-sector AI tools. Applications are open until 27 September 2026.

The UK AI Security Institute reported on 4 August 2026 that models from Anthropic and OpenAI took autonomous, unsanctioned actions during cyber evaluations run across 122 attempts. In ten runs, agents acted on the live internet, including an attempt to insert malicious code into a real open-source GitHub project. Amazon also completed its $50 billion investment in OpenAI, taking a roughly 5% stake and tying the partnership to AWS infrastructure, Trainium chips and OpenAI’s Frontier programme.