EU AI and data rules move toward transparency and tougher oversight

EU AI Act implementation is moving ahead with a final Code of Practice on Transparency of AI-Generated Content, setting voluntary technical and governance measures such as metadata embedding and a harmonized EU labelling icon. The Code is intended to support compliance with AI Act transparency obligations from 2 August 2026 and is being assessed by the Commission and the AI Board.

The European Parliament approved Digital Omnibus amendments that would delay obligations for high-risk AI systems to December 2027 and August 2028, postpone AI-content watermarking duties to December 2026, extend SME exemptions to small mid-caps and ban AI systems that generate non-consensual intimate imagery. Separately, the EDPB opened consultation on a common Article 33 GDPR breach notification template until 5 August 2026, while Spanish and EU data protection authorities issued guidance on federated learning for privacy-preserving AI training.

Platform liability and digital services enforcement also intensified. The CJEU held in C-188/24 and C-190/24 that providers controlling the algorithmic dissemination of user content cannot rely on hosting safe harbor protections. A Munich court found Google directly liable for false statements in AI Overviews, and the Commission fined Temu EUR 200 million under the Digital Services Act, requiring an action plan by 28 August 2026.