Regulatory Radar

Data Act: connected-product data and cloud switching

The Data Act applies from 12 September 2025, with specific provisions and transitions to check. It addresses connected-product data access and sharing, unfair contractual terms and switching data-processing services. It does not replace GDPR or grant unrestricted rights to personal data. Identify which chapter applies before changing a contract.

Official sources: Comisión Europea · Data Act. Scope checked on 4 November 2026.

New prohibitions and synthetic-content marking transition

The Commission’s calendar places the new prohibitions on non-consensual sexual deepfakes and child sexual abuse material on 2 December 2026. The same date ends the Article 50(2) transition for certain generative systems already on the market before 2 August 2026. It is not a general extension of all transparency duties.

Official sources: Comisión Europea · AI Act Service Desk. Scope checked on 4 November 2026.

Joint GDPR and AI Act guidelines from the EDPB and the Commission

The European Data Protection Board and the Commission are preparing guidelines on how the GDPR and the AI Act fit together, expected by the end of 2026. France's CNIL has already asked for specific recommendations for those who build and those who deploy agentic AI. Until then, national guidance (AEPD, CNIL) is the reference.

Source: Covington. Checked on 1 Nov 2026.

Digital Omnibus on data (GDPR, cookies, Data Act): Council agrees its position

This is the other half of the Digital Omnibus, separate from the part that amended the AI Act. It proposes changes to the GDPR (breach notification, access requests, data for AI training), to cookie rules and to the Data Act. The Council agreed its negotiating position on 21 October 2026; the European Parliament has not voted its own yet, so there is no final text. Today the current GDPR and cookie rules still apply.

Source: Council of the EU. Checked on 31 Oct 2026.

EN 18286: presumption limited to the requirements it covers

The publication of EN 18286:2026 through Decision 2026/2274 provides a presumption of conformity with the Article 17 quality management requirements covered by the standard. It does not establish conformity with the whole AI Act and does not replace ISO/IEC 42001. Check the standard’s coverage for your system.

Official sources: Comisión Europea · EN 18286. Scope checked on 4 November 2026.

Article 50: transparency according to your role and use

Transparency rules apply from 2 August 2026. Identify whether your role requires informing people about interaction with AI, marking generated content or disclosing particular synthetic content. Check scope and exceptions in the official guidance; the 2 December transition concerns certain Article 50(2) duties, not the whole article.

Official sources: Comisión Europea · AI Act Service Desk · Comisión Europea · AI Act. Scope checked on 4 November 2026.

Commission supervision of GPAI providers

The Commission’s AI Office has enforcement powers over GPAI models, including documentation requests, evaluations and corrective measures. Distinguish a model provider’s duties from the duties of an organisation using a third-party system. Check transition provisions rather than assuming the same date applies to every model.

Official sources: Comisión Europea · AI Act · Comisión Europea · AI Act Service Desk. Scope checked on 4 November 2026.

High-risk deadlines do not suspend other applicable duties

The official calendar sets 2 December 2027 for Annex III high-risk systems and 2 August 2028 for high-risk systems embedded in Annex I regulated products. August 2026 also brings transparency, innovation measures and enforcement for applicable provisions. Prohibitions, AI literacy and GPAI have their own earlier milestones; do not treat the postponement as a blanket exemption.

Official sources: Comisión Europea · AI Act Service Desk. Scope checked on 4 November 2026.

High-risk guidelines: agentic systems are assessed as a whole

The Commission published draft guidelines for classifying high-risk systems (Art. 6). They state that when several components or agents coordinate actions that together serve an Annex III high-risk use, the whole configuration is assessed as a single system: splitting a task across agents does not take it out of high risk. The final version is expected by the end of 2026.

Sources: European Commission · Arthur Cox. Checked on 1 Nov 2026.

NIS2 transposition remains uneven across member states

Not all EU countries have completed national transposition of the NIS2 Directive at the same pace — if you operate across several European countries, check the specific status in each jurisdiction rather than assuming one EU-wide date.

Spain's organic AI governance bill lapsed when Parliament was dissolved

The organic bill for the good use and governance of AI (approved by the Council of Ministers on 26 May 2026) lapsed on 6 October 2026, when Royal Decree 806/2026 dissolved the Cortes and called a general election for 29 November. Spain still has no national law setting AI Act authorities and penalties; the next government will have to reintroduce it. The AI Act still applies in full, because it is an EU regulation, and AESIA still exists.

Source: BOE (Royal Decree 806/2026) and regulacionia.com. Checked on 31 Oct 2026. More context in our article.

NIS2: Spain, taken to the EU Court of Justice, still has no transposition law

The Cybersecurity Coordination and Governance Law, which is meant to transpose NIS2, has not been published in the BOE. The European Commission took Spain to the CJEU in July 2026, asking for a lump sum and a daily penalty. With Parliament dissolved, the law will not move until the new legislature. Meanwhile, Royal Decree-law 12/2018 still applies.

Source: DSI. Checked on 31 Oct 2026. Which companies are in scope.

16 official guides to comply with the AI Act, plus 12 checklists

Spain's Ministry for Digital Transformation published 16 guides (first version December 2025, updated in June and July 2026 for the Digital Omnibus) and 12 self-assessment checklists, one per requirement. They are not binding and carry a Creative Commons license. We explain and put them in order in an article.

Sources: AESIA. Checked on 13 Oct 2026 in the PDFs themselves.

Spain's AEPD publishes guidance on agentic AI

An 81-page document on using AI agents to process personal data. It calls dedicated governance of agentic systems, across their whole life cycle, the most important measure. It asks for a risk analysis of each processing operation that uses agents, involvement of the data protection officer, control of agent memory and design that assumes errors will happen.

Sources: AEPD · Guide (PDF). Checked on 1 Nov 2026.

Bill naming the Bundesnetzagentur as central authority

The German cabinet approved the bill implementing the AI Act (KI-MIG) in February 2026. The Federal Network Agency (Bundesnetzagentur) would be the market surveillance authority and single point of contact; BaFin and other authorities would supervise their sectors. It still has to pass the Bundesrat and the Bundestag: check whether it is law yet.

Sources: AI Regulation · artificialintelligenceact.eu — national implementation plans. Checked on 13 Oct 2026.

France's CNIL publishes a note on agentic AI and data protection

The CNIL, with the French AI and digital council, offers pointers rather than requirements: be able to reconstruct each decision flow (data, agents and services used), partition memory by agent with expiry, require human approval for higher-risk actions, run agents in sandboxes and give users a kill switch.

Source: Covington. Checked on 1 Nov 2026.

Decentralised model, with the DGCCRF as coordinator

France plans to split supervision among the existing sector authorities, with the DGCCRF (competition, consumer affairs and fraud) as coordinator and single point of contact. It rests on a legislative proposal; the Commission lists it with the final decision pending (September 2026).

Sources: artificialintelligenceact.eu — national implementation plans · European Commission — market surveillance authorities. Checked on 13 Oct 2026.

Law 132/2025: the cybersecurity agency (ACN) supervises AI

Italy settled its set-up with Law 132/2025, in force since 10 October 2025. The National Cybersecurity Agency (ACN) is the market surveillance authority and single point of contact, and the Agency for Digital Italy (AgID) is the notifying authority.

Sources: artificialintelligenceact.eu — national implementation plans · European Commission — market surveillance authorities. Checked on 13 Oct 2026.

Ten sector authorities share supervision; the digital inspectorate (RDI) coordinates

The Netherlands splits supervision among ten sector authorities. The Data Protection Authority and the Digital Infrastructure Inspectorate (RDI) coordinate, and the RDI is the single point of contact. A draft law was published in April 2026.

Sources: artificialintelligenceact.eu — national implementation plans · European Commission — market surveillance authorities. Checked on 13 Oct 2026.

15 existing bodies supervise AI; a national AI office is on its way

Ireland named fifteen existing bodies as market surveillance authorities (Statutory Instrument 366/2025, in force). It plans a National AI Office as the single point of contact; the Commission already lists it as an authority in September 2026.

Sources: artificialintelligenceact.eu — national implementation plans · European Commission — market surveillance authorities. Checked on 13 Oct 2026.

Law 467: the Agency for Digital Government coordinates supervision

Denmark was among the first: its Law 467 has been in force since 2 August 2025. The Danish Agency for Digital Government is the notifying authority, the coordinator and the single point of contact; the Data Protection Authority and the Courts Administration also supervise.

Sources: artificialintelligenceact.eu — national implementation plans · European Commission — market surveillance authorities. Checked on 13 Oct 2026.

No federal AI law: Colorado narrows and delays its law, state laws remain in force

The US still has no federal AI law and Congress has not preempted state laws. In May 2026 Colorado replaced its 2024 law with a narrower, notice-focused framework (SB 26-189) that takes effect on 1 January 2027 alongside a chatbot law (HB 26-1263); comments on its implementing rules closed on 26 October 2026 and final rules are due before that date; in July the FTC proposed a policy statement questioning whether it may conflict with federal law. California SB 53 (in force since January 2026) and the Texas and Illinois laws keep applying. NIST AI RMF remains the reference vocabulary. Sources: Morrison Foerster · Arnold & Porter. Checked 1 Nov 2026.

AI Basic Act: notices, labelling and rules for high-impact AI

South Korea has applied its AI Basic Act since 22 January 2026, including to foreign companies. You must tell people AI is used, label generated content that could pass as real and, in sectors such as health, hiring or transport, assess impact, keep human oversight and document. Large foreign companies must appoint a local representative. Fines go up to 30 million won (about US$21,000); the ministry has indicated a one-year grace period before fining.

Sources: Cooley. Checked on 13 Oct 2026.

AI Promotion Act, Basic Plan and non-binding guidelines

Japan imposes no general obligations or penalties under its AI Promotion Act (in force since June 2025): it sets principles and creates a strategy body. The Cabinet approved the new AI Basic Plan on 14 July 2026, and the AI Guidelines for Business v1.2 (31 March 2026) are a voluntary reference.

Sources: Vorp Labs. Checked on 13 Oct 2026.

Mandatory labelling of AI-generated content and algorithm filing

China has required, since 1 September 2025, visible labels and metadata marks on AI-generated content. These add to the 2023 measures for public-facing generative AI, algorithm filing and a reference to AI in the 2025 Cybersecurity Law amendment. There is no comprehensive AI law yet: the State Council's 2026 legislative plan speaks of speeding one up.

Sources: Legal 500. Checked on 13 Oct 2026.

IT Rules: synthetic content labelling and 3-hour takedown

India amended its Information Technology Rules (notified on 10 February, in force from 20 February 2026). Permitted synthetic content must carry a visible label and permanent provenance marks, and platforms must not let anyone remove them. Government or court takedown orders must be met within 3 hours, down from 36.

Sources: Hogan Lovells. Checked on 13 Oct 2026.

Governance framework for agentic AI (voluntary)

Singapore launched its agentic AI framework on 22 January 2026, from the IMDA authority. It is not law. It rests on four ideas: limit risks up front, keep human accountability with approval checkpoints, apply technical controls, and give users transparency and the ability to switch agents off. Singapore still relies mainly on voluntary guidance.

Sources: Mondaq · Linklaters. Checked on 13 Oct 2026.

AI Law by risk tier, with a one-year grace period

Vietnam passed an AI Law in force since 1 March 2026, with a one-year grace period. It sorts systems into high, medium and low risk. High-risk systems need a conformity assessment before use and notification to the Ministry of Science and Technology; medium-risk ones mainly carry transparency duties.

Sources: Linklaters. Checked on 13 Oct 2026.

AI Basic Act: seven principles and few obligations for now

Taiwan has had its AI Basic Act in force since 14 January 2026. It sets seven principles (transparency, explainability, accountability…). For companies, the only duty for now is a warning on AI products the government deems high-risk; the Ministry of Digital Affairs must define that classification, and more obligations are expected later.

Sources: Linklaters. Checked on 13 Oct 2026.

PL 2338/2023 remains a bill

The Chamber records the bill in its special committee awaiting the rapporteur’s opinion. It is not an AI law in force. Separate proposed duties from applicable data protection obligations; a predicted vote is not a compliance deadline.

Official sources: Câmara dos Deputados · PL 2338/2023. Scope checked on 4 November 2026.

AI using personal data: check the 2025 law

The new Federal Law on Protection of Personal Data Held by Private Parties was published on 20 March 2025. AI bills do not replace this regime. Check purpose, information to individuals, security and transfers before using personal data with a provider. This entry verifies the private-sector privacy reference, not every AI bill.

Official sources: Cámara de Diputados · LFPDPPP. Scope checked on 4 November 2026.

Law 21.719 takes effect on 1 December 2026

The data protection reform and the creation of the Agency take effect on 1 December 2026. This is separate from the AI bill, bulletins 16821-19 and 15869-19, recorded by the Chamber at its second constitutional stage. Prioritise processing records, lawful use, rights, contracts and owners; do not describe the AI bill as an enacted law.

Official sources: Biblioteca del Congreso Nacional · Ley 21.719 · Cámara de Diputadas y Diputados · Boletín 16821-19. Scope checked on 4 November 2026.

Law 31814: regulation and scope of application

Supreme Decree 115-2025-PCM, published on 9 September 2025, approves the regulation of Law 31814. Its final provision sets entry into force 90 working days after publication. The framework distinguishes uses by risk. Check organisational scope and specific transitional provisions before treating all controls as identical immediate duties.

Official sources: PCM · Decreto Supremo 115-2025-PCM. Scope checked on 4 November 2026.

AI Convention: signature is not ratification

The Council of Europe confirms Uruguay signed its Framework Convention on AI on 2 September 2025. The announcement establishes signature, not ratification or domestic application. Check ratification, entry into force and domestic measures separately when assessing treaty-based duties.

Official sources: Consejo de Europa · firma de Uruguay. Scope checked on 4 November 2026.

Law 25.326: personal data in AI projects

The updated text of Law 25.326 is a reference for assessing personal data processing. Before reusing a dataset in AI, check purpose, quality, information, security and individual rights. This entry covers that privacy reference and does not rule out sector-specific rules or developments in AI bills.

Official sources: Argentina · Ley 25.326, texto actualizado. Scope checked on 4 November 2026.

Circular 002 of 2024: personal data in AI systems

On 21 August 2024 the SIC issued instructions on personal data processing in AI systems. Read this specific reference alongside the applicable data protection regime; a statement about the absence of a general AI law is insufficient. Review controller or processor roles, security and accountability for the actual processing.

Official sources: SIC · Circular Externa 002 de 2024. Scope checked on 4 November 2026.

Law 7593/2025: prepare the data protection transition

The Congressional Library publishes personal data protection Law 7593/2025. Article 57 provides for entry into force 24 months after official publication; the library page’s update date does not establish application. Article 60 provides for implementing regulations during that period. Prepare inventories and ownership, and verify official publication, regulations and deadlines before calculating a specific date.

Official sources: Biblioteca del Congreso Nacional · Ley 7593/2025. Scope checked on 4 November 2026.

No AI law: principles and existing regulators, plus a sandbox bill announced

The UK has no AI-specific law and has not published a draft. It applies five general principles through each sector's regulators (ICO, CMA, FCA and Ofcom). The 2025 data law changed the rules on automated decisions, and the ICO announced a code on AI and automated decision-making. In May 2026 the government announced a "Regulating for Growth Bill" with sandbox powers to test products by temporarily relaxing some rules.

Sources: RPC. Source dated 1 Jun 2026.

It will adopt the Council of Europe convention and regulate by sector

On 12 February 2025 the Federal Council decided to bring the Council of Europe AI Convention into Swiss law. Changes will be sector-specific where possible, with general rules only in fundamental-rights areas such as data protection. Non-binding measures such as industry agreements will be added. A consultation draft is expected at the end of 2026.

Sources: BAKOM (Suiza). Checked on 13 Oct 2026.

No federal AI law: AIDA lapsed and privacy law applies

The proposed federal AI law (AIDA) died when Parliament was prorogued on 6 January 2025, and the minister has said it will not return as drafted. In February 2026 the government published a consultation summary, which is not a bill. Meanwhile the federal privacy law (PIPEDA), Quebec's Law 25 (automated decisions; fines up to CAD 10 million or 2% of turnover) and a voluntary code for generative AI apply.

Sources: Compliance Hub. Source with status as of August 2026.

National AI Plan: no specific mandatory rules, existing laws apply

The National AI Plan, published on 2 December 2025, dropped the ten mandatory guardrails proposed in 2024. The approach is to regulate as necessary but as little as possible, with technology-neutral rules: privacy, consumer, copyright and employment law apply, plus sector regulation. An AI safety institute, advisory only, was planned for early 2026.

Sources: SoftwareSeni. Checked on 13 Oct 2026.