EU AI Act

State of play.

• The Digital Omnibus on AI has resolved the August 2026 deadline crisis — but replaced it with a new compliance calendar. Regulation (EU) 2026/1744 entered into force July 27, 2026, deferring high-risk obligations to December 2027 for standalone AI systems and August 2028 for AI embedded in regulated products; transparency requirements took effect August 2, 2026 as originally scheduled .
• The EU AI Office's mandate has expanded under the Omnibus, restructuring the national/EU-level oversight architecture and creating new compliance reference points that organizations must map against their existing programs .
• The EU is embedding compliance requirements into AI infrastructure at the foundational layer. The Commission's €30 billion gigafactory tender — up to seven facilities, applications closing November 12 — explicitly conditions participation on EU data protection, safety, and security standards, making regulatory alignment a procurement prerequisite rather than an afterthought .
• Deployer liability for agentic AI systems is now enforceable, not theoretical. The EU AI Act's deployer-responsibility framework assigns liability to the entity controlling scope, permissions, and oversight — and organizations without documented governance structures for autonomous agents face material exposure .
• For counsel advising clients with EU market exposure, the practical baseline has shifted: the August 2026 crisis is resolved, but organizations that reallocated compliance resources in response to the Omnibus must now re-sequence against December 2027 and August 2028 deadlines while maintaining the transparency obligations that took effect immediately.

Where things stand.

• The AI Act's staggered implementation timeline has been materially reset by the Omnibus. Prohibited AI systems remain banned from February 2025; GPAI obligations remain in force from August 2025; high-risk system compliance is now December 2027 (standalone) and August 2028 (embedded); transparency requirements are live as of August 2, 2026 .
• Notified body capacity and missing harmonized standards remain structural gaps. The Omnibus extended deadlines in part because these infrastructure bottlenecks were acknowledged as unresolved — the additional runway does not guarantee they will be resolved before the new deadlines .
• Medical device manufacturers face a convergent AI Act / MDR / IVDR compliance burden. The Commission's December 2025 MDR/IVDR revision proposal mandates AI Act alignment for software-as-medical-device; the Omnibus deadline extensions provide some relief but do not eliminate the overlap .
• Deployer liability for agentic AI is the Act's next enforcement frontier. The deployer-responsibility framework under Regulation 2024/1689 — requiring documented role definitions, impact assessments, and audit trails — is now enforceable, with liability flowing to the entity that controls the agent's authority and scope .
• Enterprise AI contract terms are converging on a recognizable standard that maps EU AI Act and NIST compliance obligations into MSA language — shorter terms, no automatic renewals, strict data-use limits, explicit output ownership, and audit rights are becoming baseline expectations in vendor negotiations .
• Vendor "service improvement" clauses are now recognized as AI training risk vectors. Law firms including Kilpatrick Townsend, Consilium Law, and SiLaw have published redlining guides demanding explicit "no training," "no commingling," and "no retention" language — the compliance gap between regulated government contracts and commercial MSAs creates exposure for clients in EU-regulated jurisdictions .
• DMA gatekeeper designation challenges have been foreclosed by the General Court. The Luxembourg court upheld Apple's gatekeeper classification, eliminating designation challenges as a compliance strategy and clearing the path for enforcement actions — Apple faces a €569.5 million fine for prior DMA violations .
• ALSPs are positioning as EU AI Act compliance intermediaries, with regulatory sandboxes formally established by the EU functioning as lower-risk testing infrastructure for legal AI deployment .
• AI inference capabilities continue to outpace data protection frameworks, with liability for data misuse increasingly attaching to deployers rather than developers — a pattern the Act's provider/deployer/importer allocation is still being tested against .

Latest developments.

• Regulation (EU) 2026/1744 entered into force July 27, 2026, deferring high-risk AI compliance to December 2027 (standalone) and August 2028 (embedded products); transparency requirements effective August 2, 2026 as scheduled; EU AI Office mandate expanded .
• EU Commission launched a formal tender for up to seven AI gigafactories, a €30 billion public-private initiative targeting €10 billion in public funding; applications close November 12, winners expected early 2027; facilities will embed EU compliance requirements at the infrastructure layer .
• Enterprise AI contract terms are converging on a market-wide standard — 12-month caps, no auto-renewals, strict data-use limits, explicit output ownership, audit rights — with EU AI Act compliance frameworks being mapped into MSA language .
• Vendor "service improvement" clauses are being urgently reclassified as AI training risk vectors, with major law firms publishing redlining guides demanding explicit no-training, no-commingling, and no-retention provisions in commercial MSAs .
• Deployer liability for autonomous AI agents is now enforceable under the EU AI Act and Colorado's AI Act, with organizations required to document agent authorization, implement audit trails, and maintain human oversight mechanisms .
• EU General Court rejected Apple's DMA gatekeeper designation challenge, eliminating designation challenges as a compliance strategy; Apple faces a €569.5 million fine for prior violations .
• Consumer Federation of America filed suit against Meta in Washington, DC, alleging AI-powered advertising tools enabled consumer fraud and harmful ads targeting minors — the complaint tests whether platforms are liable for AI-generated harms where the platform controls both the tool and the approval process .

Active questions and open splits.

• How organizations should re-sequence compliance programs after the Omnibus reset. The December 2027 and August 2028 deadlines provide runway, but the transparency obligations that took effect August 2, 2026 are live now — organizations that paused programs pending Omnibus relief must immediately audit which obligations are already in force .
• Whether the Omnibus's expanded EU AI Office mandate creates new enforcement vectors before the high-risk deadlines. The restructured national/EU-level oversight architecture is not yet fully mapped — it is unclear whether the Office will use its expanded mandate to issue guidance, initiate investigations, or both, ahead of 2027 .
• How "double regulation" for embedded AI systems resolves in practice. The Omnibus extended the embedded-product deadline to August 2028, but manufacturers of AI-embedded medical devices still face simultaneous MDR/IVDR obligations with overlapping but non-identical requirements — the Omnibus provides time, not harmonization .
• Whether deployer liability for agentic AI extends to AI agents operating across jurisdictional boundaries. The EU Act assigns liability to the deployer controlling the agent — but where an agent autonomously communicates with regulators or counterparties in multiple jurisdictions, the liability allocation between deployer and provider remains actively contested .
• Whether enterprise AI contract terms converging on a market standard will be treated as industry practice in EU enforcement. The emerging MSA playbook maps EU AI Act obligations into contract language — but whether regulators will treat contractual allocation of compliance obligations as satisfying the Act's direct regulatory requirements is unresolved .
• Whether the CFA's Meta theory — platform liability for AI-generated harms where the platform controls the tool and the approval process — gains traction in EU enforcement. The EU AI Act's deployer framework and the DMA's gatekeeper obligations create parallel EU-side exposure for the same conduct alleged in the DC suit .
• Whether regulatory sandboxes under the Act provide meaningful compliance safe harbors. The EU has established sandbox frameworks and ALSPs are positioning to exploit them — but the scope of protection and eligibility conditions remain underspecified, and the Omnibus's restructuring of the AI Office may alter sandbox governance .

What to watch.

• EU AI Office guidance on which transparency obligations took effect August 2, 2026 and how they will be enforced — this is the immediate compliance question for organizations that adjusted programs in anticipation of Omnibus relief.
• Gigafactory tender winners (expected early 2027) and the contract terms they accept — these will establish the de facto compliance baseline for EU AI infrastructure investment and shape the commercial landscape for the next decade.
• Whether the EU AI Office uses its expanded mandate to issue authoritative guidance on agentic AI classification before the December 2027 high-risk deadline.
• Progress of MDR/IVDR revision through Parliament and Council — if adopted as proposed, it materially eases certification timelines for AI-embedded medical devices; if stalled, manufacturers face the Omnibus's August 2028 deadline against an unresolved double-regulation burden.
• Whether the CFA v. Meta litigation in Washington, DC produces early rulings on platform liability for AI-generated harms — a favorable precedent for plaintiffs would accelerate parallel EU enforcement theories under the DMA and AI Act deployer framework.
• Whether state AG enforcement under California's 2026 AI transparency laws produces the first US-side precedents on AI inference liability, creating a compliance reference point that interacts with EU enforcement posture.