Europe advances AI transparency, child safety and cyber resilience rules

EU AI Act transparency obligations took effect on 2 August 2026, requiring disclosures for AI interactions, machine-readable marking of synthetic content and disclosure of deepfakes. The Digital Omnibus revises compliance requirements and timelines, with Annex III high-risk obligations applying from 2 December 2027 and product-linked high-risk obligations from 2 August 2028. The European Commission is also consulting on copyright licensing, remuneration and protections against AI-generated imitations.

The proposed EU KIDS Act would introduce harmonised age restrictions, privacy-preserving age assurance and safety-by-design requirements. Its scope includes social platforms, AI companions, conversational chatbots, games and app stores, with safeguards against emotional dependency and mandatory child-safety testing. Adoption is not expected before 2028. Consumer authorities are separately challenging in-game currency practices that obscure prices or undermine consumer rights.

Cyber Resilience Act vulnerability and incident reporting became mandatory on 11 September 2026, including for legacy products. Connected-product data accessibility requirements followed on 12 September 2026. EU and UK financial supervisors are expanding third-party oversight while warning that AI-driven vulnerability discovery is outpacing remediation. Firms are being urged to test patching, monitoring and supplier readiness.

The UK has brought forward its subscription contracts regime to January 2027, requiring clearer information, renewal reminders and straightforward cancellation. Germany’s proposed Digital Media State Treaty would make AI information services responsible for generated content and impose additional transparency and journalistic duties on larger services. The proposal could also cover providers established outside Germany when their services target German users.