EU and UK accelerate AI rulemaking

The EU’s AI Omnibus package entered into force on 27 July, revising parts of the AI Act as staged implementation continues. The changes include a grace period for some marking obligations, giving providers with AI systems on the market before 2 August 2026 a four month transitional period that effectively delays application to 2 December 2026.

High-risk obligations have also been pushed back, with Annex 3 rules applying from 2 December 2027 and Annex 1 rules from 2 August 2028. The package narrows parts of the high-risk regime, bans nudification apps that generate non-consensual sexually explicit and intimate content or CSAM, simplifies AI literacy duties, and expands the AI Office’s enforcement role for certain systems.

The AI Act applies generally from 2 August, bringing key enforcement and transparency provisions into effect, subject to the revised timetable. The EU has also issued guidelines on transparency for AI-generated content, while the European Data Protection Board has published draft guidance confirming web scraping falls within the GDPR whenever personal data is collected.

In the UK, Andy Burnham has appointed a Minister for AI, created an AI Taskforce and placed AI at the centre of economic and public service plans. The dismantling of DSIT has prompted concerns about loss of focus and expertise, leaving uncertainty over whether UK-specific AI legislation remains on the agenda.