The EU AI Act Deadline That Did Not Move: What US AI Companies Owe by August 2, 2026

By Chanté Eliaszadeh | July 2026

On June 29, 2026, the Council of the European Union gave its final green light to the Digital Omnibus on AI, and the coverage wrote itself: the EU delayed the AI Act.¹ The headlines are half right. The high-risk compliance dates moved to December 2, 2027 and August 2, 2028.² The two obligations that reach US AI companies first did not move at all — and they take effect on August 2, 2026, sixteen days from the date of this article.

If you run a US AI company with EU-reachable users — a chatbot, an AI agent, a generative tool, or a general-purpose model — and no EU entity, the delay you read about is not your delay. Article 50’s transparency obligations and the European Commission’s enforcement powers over general-purpose AI models both switch on August 2, 2026, on the original schedule,³ and a transparency breach carries fines up to EUR 15,000,000 or up to 3% of total worldwide annual turnover, whichever is higher.⁴

There is a second fact the coverage mostly skips. As of July 17, 2026, the Digital Omnibus has not been published in the Official Journal of the European Union: the EUR-Lex record for Regulation (EU) 2024/1689 lists no amending act — only corrigenda and two proposal-stage documents.⁵ Until the amending regulation is published and enters into force, the deferrals everyone is relying on are not yet law. This article maps which EU AI Act obligations actually apply to a US AI company on August 2, 2026, which ones moved, and what to do with the days that remain.

Key Takeaways

• The deadline that matters did not move. Article 50 transparency obligations apply from August 2, 2026; the Digital Omnibus defers the high-risk dates to December 2, 2027 and August 2, 2028, not Article 50.³
• The Act reaches US companies with no EU office. Article 2(1) covers providers placing AI systems or GPAI models on the EU market from any third country, and non-EU providers and deployers where the system’s output is used in the Union.⁶
• A transparency breach carries fines up to EUR 15,000,000 or up to 3% of total worldwide annual turnover under Article 99(4) — the top tier (up to EUR 35,000,000 or up to 7%) is reserved for Article 5 prohibited practices, a different failure.⁴
• The deferrals are not yet law. As of July 17, 2026, no Official Journal publication of the Digital Omnibus is confirmed; until publication plus three days, the original AI Act dates remain the law in force.⁵
• The stability assumption is inverted. Executive Order 14365 puts the US state AI patchwork under active federal preemption pressure; the EU’s August 2 transparency date has survived every simplification round untouched.⁷

Did the EU AI Act’s August 2026 Deadline Get Delayed?

Partly — and that is the trap. The Digital Omnibus moved the high-risk deadlines to December 2, 2027 and August 2, 2028, but Article 50’s transparency obligations still take effect on August 2, 2026, on schedule.²

The Digital Omnibus on AI is the EU’s amending regulation that simplifies the AI Act and defers its high-risk compliance dates — proposed by the European Commission on November 19, 2025 and adopted by the Council on June 29, 2026.⁸ What it never touched is the effective date of Article 50, the transparency chapter that governs chatbots, synthetic content, and deepfakes. Its only change to Article 50 was additive: it introduced a marking grace period, running to December 2, 2026, for generative systems already on the market — a transitional measure discussed below.⁹

As of July 17, 2026, the Digital Omnibus moves three of the six headline EU AI Act compliance dates and adds a seventh; the three dates it leaves in place — Article 50 transparency, GPAI model obligations, and Commission GPAI enforcement — are precisely the ones that reach US companies by August 2, 2026.⁵

The Omnibus Reset Table — What Moved, What Held, and What Is Actually Law Today

If your compliance calendar moved everything EU to 2027, re-open it — the entries due August 2, 2026 never moved.

Is the Digital Omnibus Actually Law Yet?

Not yet, as of mid-July 2026. Parliament endorsed the Omnibus on June 16 and the Council adopted it on June 29, but it takes legal effect only three days after Official Journal publication — which has not been confirmed.¹¹⁰

The dated record runs: Commission proposal, November 19, 2025; European Parliament endorsement, June 16, 2026, by a vote of 423 to 57 with 174 abstentions; Council of the EU final adoption, June 29, 2026.¹¹⁰ What the record does not yet contain is the step that makes any of it law: publication in the Official Journal. As of July 17, 2026, EUR-Lex shows Regulation (EU) 2024/1689 amended by nothing — four corrigenda and two proposal-stage documents, no L-number for an amending regulation.⁵

That sequencing carries more weight than it sounds. Under the adopted text, the amending regulation enters into force on the third day after publication.¹¹¹ Until that day, the original AI Act dates — including, technically, the original August 2, 2026 date for Annex III high-risk systems — remain the law in force. The deferral the market is relying on is itself racing the deadline it defers. Publication before August 2 is expected; it is not yet a fact.

If your August plan assumes the 2027 high-risk date, write the assumption down: it becomes law only when the Omnibus publishes. Check EUR-Lex before you rely on it.

Does the EU AI Act Apply to a US Company With No EU Office?

Yes. Article 2(1) reaches providers placing AI systems or GPAI models on the EU market from any third country — and providers and deployers located outside the EU “where the output produced by the AI system is used in the Union.”⁶

The statute is explicit on both hooks. Article 2(1)(a) applies the Act to providers placing AI systems or general-purpose AI models on the market in the Union “irrespective of whether those providers are established or located within the Union or in a third country,” and Article 2(1)(c) reaches providers and deployers in a third country “where the output produced by the AI system is used in the Union.”⁶ Commentators have compared the design to the GDPR’s impact-based reach, and the comparison is apt: the trigger is effect in the Union, not presence in it.¹²

Precision matters here, because the blanket “it applies to you” framing skips the operative analysis. Placing on the market means the first making available of a system in the Union in the course of a commercial activity — mere technical reachability is not the test.¹³ A US chatbot company that offers paid plans to EU users, prices in euros, or targets EU customers has placed its system on the EU market. A US employer using an AI tool to screen candidates located in the EU has output used in the Union. A US-only product that an EU traveler happens to open has, without more, neither. The question is offering and use, not whether an IP address in Brussels can load your page.

If you offer your AI product to EU users — or its output does work in the EU — assume Article 2(1) reaches you and run the bucket test below.

What Actually Takes Effect on August 2, 2026?

Two things: Article 50 transparency obligations for AI systems that interact with people or generate synthetic content, and the Commission’s enforcement powers over general-purpose AI models — fines included. The Digital Omnibus deferred neither.²

Article 50 is the EU AI Act’s transparency chapter for limited-risk systems: AI that interacts directly with people, generates synthetic audio, image, video, or text, runs emotion recognition or biometric categorisation, or produces deepfakes.³ General-purpose AI obligations are the Chapter V duties on model providers — technical documentation, a copyright policy, a summary of training content — and they have been in force since August 2, 2025; what begins on August 2, 2026 is the Commission’s power to enforce them.¹⁴ The classification work runs by system function and the role you hold, not corporate footprint — the question is never “are we an EU company,” it is “which bucket is each system in.”

If a system you provide or deploy talks to people, generates content, reads emotion, or makes deepfakes for EU users, August 2 is its date — bucket each one below.

Which Article 50 Bucket Is Your AI System In?

Article 50 assigns duties by system function and your role. Providers owe interaction disclosure (Art. 50(1)) and machine-readable output marking (Art. 50(2)); deployers owe emotion-recognition notice (Art. 50(3)) and deepfake disclosure (Art. 50(4)). Many companies are both.³

The role definitions carry the weight. A provider develops an AI system or GPAI model and places it on the market or puts it into service under its own name or trademark; a deployer uses an AI system under its own authority, other than in the course of a purely personal, non-professional activity.¹⁵ A US company that builds a model and ships the product on top of it wears both hats at once — which is also where deployer-side exposure begins, a dynamic we traced in the US context in our analysis of AI agent deployer liability.

The statutory language is worth reading directly. Interaction disclosure applies unless the AI nature of the system is obvious “from the point of view of a natural person who is reasonably well-informed, observant and circumspect.”³ The marking duty covers systems “generating synthetic audio, image, video or text content.”³ And the timing rule is uniform: the required information must reach the person “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure.”³

The August 2 Bucket Test

† Grace period introduced by the Digital Omnibus; available only once the Omnibus enters into force (OJ publication + 3 days).⁹

If your company builds the model and runs the product, you likely sit in two buckets at once — classify each system in each role, not the company once.

What Is the Synthetic-Content Marking Obligation, and Who Gets the Grace Period?

Article 50(2) requires providers of generative systems to mark synthetic audio, image, video, and text outputs in a machine-readable, detectable format. The Digital Omnibus adds a grace period to December 2, 2026 for systems on the market before August 2, 2026 — available only once the Omnibus enters into force. Later systems get none.⁹

The engineering standard is written into the statute: marking solutions must be “effective, interoperable, robust and reliable as far as this is technically feasible,” taking account of the state of the art and implementation cost.³ The obligation carries its own carve-outs — it does not apply to the extent a system performs an assistive function for standard editing or does not substantially alter the deployer’s input or its meaning, and law-enforcement uses authorised by law are excepted.³ The rest of Article 50 — interaction disclosure, deepfake disclosure — gets no grace period at all.

Two implementation details matter. First, sources conflict on whether to call the grace period a three-month or four-month window; only the December 2, 2026 end date is consistent across them — plan to the date, not the duration.⁹ Second, the grace period is an Omnibus-introduced transitional measure, not part of the original AI Act: a provider planning around it, as of July 17, 2026, is planning around a provision that is not yet law. Implementation aids exist on both fronts: the Commission published draft guidelines on Article 50’s scope on May 8, 2026,¹⁶ and the Code of Practice on Transparency of AI-Generated Content followed on June 10, 2026.¹⁷

If your generative product ships before August 2, the grace period can buy marking time to December 2, 2026 — but it exists only once the Omnibus is in force. Build as if it may not be.

What Are the Fines for Missing the August 2026 Obligations?

An Article 50 breach carries fines up to EUR 15,000,000 or up to 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)). The EUR 35,000,000 / 7% tier is reserved for prohibited practices under Article 5 — a different failure.⁴

Article 99(4) names Article 50 expressly in its list, so the tier assignment is statutory, not interpretive.⁴ For SMEs and startups the rule inverts: Article 99(6) caps their fines at whichever of the percentage or fixed amount is lower — and the adopted Omnibus text extends that proportionate-cap treatment, along with other SME simplifications, to a new “small mid-cap” tier.¹¹

The next question is who actually fines you. Article 50 is enforced by national market-surveillance authorities under member-state penalty regimes — Article 99(1) leaves member states to lay down the penalty rules and notify the Commission; the Commission’s direct fining power runs only against GPAI model providers, under Article 101.¹⁸ Either way, turnover-based caps mean exposure scales with your whole business, not your EU revenue.

The national machinery is unevenly built. Member states were required to designate their authorities by August 2, 2025, yet as of June 17, 2026 only nine of twenty-seven had clearly done so — Italy’s regime is in force (Law No. 132/2025, effective October 10, 2025), while Germany’s designation of the Bundesnetzagentur was still pending parliamentary approval.¹⁹ The deadline is fixed even where the enforcer is not yet staffed — a reason to expect uneven early enforcement, not a reason to skip the disclosure work.

If your AI product touches EU users, price the exposure off worldwide turnover — the 3% cap does not care where your revenue sits.

Where Do General-Purpose AI Model Obligations Stand?

General-purpose AI model obligations have applied since August 2, 2025; what changes on August 2, 2026 is that the Commission can start enforcing them.¹⁴

• August 2, 2025 — Chapter V obligations (Arts. 51-56) took effect for new GPAI models: technical documentation, a copyright-compliance policy, a public summary of training content.¹⁴
• August 2, 2026 — the Commission’s fining power over GPAI model providers begins (Article 101); its information-request and model-evaluation powers, in force since August 2, 2025, now carry the threat of penalties.²⁰
• August 2, 2027 — legacy models placed on the market before August 2, 2025 must be brought into compliance.²⁰

A general-purpose AI model is one trained on broad data at scale that can competently perform a wide range of distinct tasks and can be integrated into downstream systems — the foundation-model layer, in industry terms.²¹ For providers weighing how to demonstrate compliance, the finalized GPAI Code of Practice is the Commission-endorsed vehicle: signing it is voluntary, and Meta — which publicly declined to sign in July 2025²² — is absent from the participant list in the Commission’s Signatory Taskforce Vademecum.²³ The Omnibus also reportedly broadens AI Office competence to AI systems built on GPAI models within the same undertaking — squarely relevant to a US company that builds the model and ships the product.²

If you provide a GPAI model available in the EU, August 2 is when the AI Office can start asking questions with penalties attached — have the documentation and training-content summary ready before the letter arrives.

Which Deadlines Actually Moved — and When Do the New Ones Bite?

The Omnibus moves standalone high-risk obligations (Annex III) to December 2, 2027 and product-embedded high-risk obligations (Annex I) to August 2, 2028 — once it enters into force. It also adds a new Article 5 prohibition effective December 2, 2026.²

The two annexes divide the high-risk universe. Annex III covers standalone high-risk systems — AI used in hiring, credit decisions, education, and similar listed domains. Annex I covers AI embedded in products already governed by EU product-safety law: medical devices, machinery, toys. Under the adopted Omnibus text, Annex III obligations slide from August 2, 2026 to December 2, 2027, and Annex I obligations from August 2, 2027 to August 2, 2028.²

The addition cuts the other way. The Omnibus adds a new prohibited practice to Article 5: AI systems for generating child sexual abuse material or non-consensual intimate content, reaching systems where such generation is a reasonably foreseeable and reproducible outcome absent adequate safeguards, with a safe harbour for effective preventive safeguards.²¹¹ It takes effect December 2, 2026 — its own date, not August 2 — and because it lands in Article 5, a breach sits in the top EUR 35,000,000 / 7% tier, not the Article 50 tier.⁴

If your roadmap includes hiring, credit, education, or product-embedded AI for the EU, the 2027-2028 dates are your build window — and the new content prohibition arrives earlier, on December 2, 2026.

What Did the Omnibus Actually Give Startups and Scale-Ups?

Real relief, mostly deferred value: SME simplifications — lighter technical documentation, proportionate quality-management expectations, priority sandbox access, and lower penalty caps — now extend to a new “small mid-cap” tier, and the national-sandbox deadline slid to August 2, 2027.²¹¹

The package, per the adopted text (Official Journal publication pending):²¹¹

• A new “small mid-cap” category extending SME documentation and quality-management simplifications and proportionate penalty caps beyond SMEs.
• The member-state duty to establish at least one AI regulatory sandbox, deferred one year to August 2, 2027, with real-world testing expanded to Annex I high-risk systems.
• The AI-literacy obligation softened from a duty to “take measures to ensure, to their best extent, a sufficient level of AI literacy” to a duty to “take measures to support the development of AI literacy.”
• Trimmed registration data points under Annex VIII.
• Expanded AI Office supervisory powers, including competence over AI systems built on GPAI models within the same undertaking.

None of this relief moves the August 2, 2026 transparency date. It lightens the 2027-2028 high-risk build, not the disclosure work due now.

How Does the EU Deadline Interact With US State AI Laws — and Which Side Is More Likely to Change?

The transparency theme converges; the triggers do not. California’s TFAIA and New York’s RAISE Act key on frontier-developer scale, Texas’s TRAIGA on enumerated harms — EU Article 50 keys on what your system does, regardless of company size. And of the two regimes, the US side is the one likely to move: the EU date is the firm ground.²⁴²⁵²⁶

Trigger Anatomy: EU Art. 50 vs. the US Patchwork

Colorado is the patchwork’s own cautionary tale: the Colorado AI Act (SB 24-205), signed in May 2024, was repealed and reenacted by SB 26-189 — signed May 14, 2026, effective August 12, 2026 — before its original framework ever settled.²⁷ The convergence is real, though: content-provenance marking and AI-interaction disclosure serve EU Article 50(2) and 50(4) and much of the state disclosure patchwork at once. Build once, comply broadly — as an engineering design strategy, not a compliance guarantee. The domestic side is covered in the 2025 state AI law patchwork we mapped and in our analysis of California’s SB 53 frontier AI law.

And the stability assumption is inverted: the EU’s August 2 date is the firm ground; the US patchwork is the moving target. Executive Order 14365 (December 11, 2025) directs the Attorney General to establish, within 30 days, a DOJ AI Litigation Task Force to challenge state AI laws, directs the Commerce Secretary within 90 days to make states with disfavored AI laws ineligible for certain BEAD non-deployment funds, and directs FTC guidance on when state laws requiring “alterations to the truthful outputs of AI models” conflict with federal deceptive-practices law.⁷ There is no EU analogue: Article 50’s date has survived every round of simplification untouched. For the preemption fight itself, see where federal AI policy stands after the preemption Executive Order.

If you are sequencing compliance builds, anchor on the EU’s fixed August 2 date and treat the US patchwork as the variable — not the reverse.

What Should a US AI Company Do Before August 2, 2026?

Four moves: classify every AI system against the Article 50 buckets, stand up interaction disclosure for EU-reachable chatbots and agents, scope machine-readable output marking now, and document the analysis — the same provenance layer serves much of the US patchwork.

1. Classify. Run every AI system through the August 2 Bucket Test above, in each role you hold — provider, deployer, or both. Record the scope conclusion under Article 2(1) for each system, including the ones you conclude are out of scope and why.

2. Disclose. For EU-reachable chatbots and agents, stand up Article 50(1) interaction disclosure now — clear, at or before first interaction, unless AI-ness is genuinely obvious to a reasonably well-informed user. This duty has no grace period.

3. Mark. Scope the Article 50(2) machine-readable marking build immediately. If your system is on the market before August 2, the Omnibus grace period may buy you until December 2, 2026 — but only once the Omnibus is in force, so treat the grace period as contingency, not plan.

4. Document. Write down the classification, the disclosures, and the marking approach. The same provenance and disclosure layer does double duty across much of the US state patchwork — and the record is what you hand a market-surveillance authority, or a court, when the question arrives.

A jurisdictional note: we are US counsel who help US companies scope cross-border AI exposure; for definitive advice on EU-law obligations, engage EU-qualified counsel. And one perishability note: the single fact most likely to change after this article’s date is the Digital Omnibus’s Official Journal status — check EUR-Lex for the L-number before relying on the 2027-2028 dates as law. The August 2, 2026 date needs no such check. It was never in motion.

Related Resources

• Federal AI Regulation Landscape
• State AI Law Patchwork 2025
• California’s Frontier AI Law: SB 53
• Not an Agent, Not a Defense: AI Agent Deployer Liability

This article provides general information for educational purposes only and does not constitute legal advice. AI regulation is evolving rapidly, and the legal status of the Digital Omnibus described here is as of July 17, 2026. Consult qualified legal counsel — including EU-qualified counsel for EU-law obligations — for advice on your specific situation. Attorney Advertising.

Footnotes

1. Council of the European Union, Press Release, “Artificial intelligence: Council gives final green light to simplify and streamline rules” (June 29, 2026), available at https://www.consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/. ↩ ↩² ↩³ ↩⁴

2. Freshfields, “EU AI Act unpacked #34: The final Digital Omnibus on AI” (July 10, 2026), available at https://www.freshfields.com/en/our-thinking/blogs/technology-quotient/eu-ai-act-unpacked-34-the-final-digital-omnibus-on-ai-key-amendments-to-the-a-102nber. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹

3. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (EU AI Act), arts. 50, 113, OJ L, 2024/1689, 12.7.2024, available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689; article text as reproduced at https://artificialintelligenceact.eu/article/50/. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹

4. EU AI Act arts. 5, 99, OJ L, 2024/1689, 12.7.2024, available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689; article text as reproduced at https://artificialintelligenceact.eu/article/99/ and https://artificialintelligenceact.eu/article/5/. ↩ ↩² ↩³ ↩⁴ ↩⁵

5. EUR-Lex, document information and amendment record for Regulation (EU) 2024/1689 (CELEX:32024R1689), available at https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32024R1689 (last checked July 17, 2026: no amending act published; proposals 52025PC0836 and 52025PC1023 listed as “Amendment proposed”). The date-mapping in this article is Astraea Counsel’s analysis of Regulation (EU) 2024/1689, the adopted Digital Omnibus text as reported by the Council of the EU, and this EUR-Lex status record. ↩ ↩² ↩³ ↩⁴

6. EU AI Act art. 2(1), OJ L, 2024/1689, 12.7.2024, available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689; article text as reproduced at https://artificialintelligenceact.eu/article/2/. ↩ ↩² ↩³

7. Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence” (Dec. 11, 2025), available at https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy/. ↩ ↩²

8. European Commission, “AI Act” (regulatory framework for AI policy page), available at https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai. ↩

9. Gibson Dunn, “EU AI Act Omnibus: Agreement Postpones High-Risk Deadlines and Other Key Changes” (May 27, 2026), available at https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/. ↩ ↩² ↩³ ↩⁴

10. European Parliament, Legislative Train Schedule, “Digital Omnibus on AI” (endorsement of June 16, 2026), available at https://www.europarl.europa.eu/legislative-train/package-digital-package/file-digital-omnibus-on-ai. ↩ ↩²

11. Digital Omnibus on AI, adopted text, PE-CONS 30/26 (signed July 8, 2026; awaiting Official Journal publication), available at https://data.consilium.europa.eu/doc/document/PE-30-2026-INIT/en/pdf. ↩ ↩² ↩³ ↩⁴ ↩⁵

12. Holland & Knight, “US Companies Face EU AI Act’s Possible August 2026 Compliance Deadline” (Apr. 28, 2026), available at https://www.hklaw.com/en/insights/publications/2026/04/us-companies-face-eu-ai-acts-possible-august-2026-compliance-deadline. ↩

13. EU AI Act art. 3(9)-(11) (definitions of placing on the market, making available on the market, and putting into service), OJ L, 2024/1689, 12.7.2024, available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689. ↩

14. European Commission, “Guidelines for providers of general-purpose AI models,” available at https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers. ↩ ↩² ↩³

15. EU AI Act art. 3(3)-(4) (definitions of provider and deployer), article text as reproduced at https://artificialintelligenceact.eu/article/3/. ↩

16. European Commission, Press Release, “Commission opens consultation on draft guidelines for AI transparency obligations” (May 8, 2026), available at https://digital-strategy.ec.europa.eu/en/news/commission-opens-consultation-draft-guidelines-ai-transparency-obligations. ↩

17. European Commission, Code of Practice on AI-generated content (marking and labelling), available at https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content. ↩

18. EU AI Act arts. 70, 99(1), 101, article text as reproduced at https://artificialintelligenceact.eu/article/70/, https://artificialintelligenceact.eu/article/99/, and https://artificialintelligenceact.eu/article/101/. ↩

19. artificialintelligenceact.eu, “National Implementation Plans” tracker (as of June 17, 2026), available at https://artificialintelligenceact.eu/national-implementation-plans/. ↩

20. Latham & Watkins, “EU AI Act: GPAI Model Obligations in Force and Final GPAI Code of Practice in Place” (2025), available at https://www.lw.com/en/insights/eu-ai-act-gpai-model-obligations-in-force-and-final-gpai-code-of-practice-in-place. ↩ ↩²

21. EU AI Act art. 3(63) (definition of general-purpose AI model), OJ L, 2024/1689, 12.7.2024, available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689. ↩

22. TechCrunch, “Meta refuses to sign EU’s AI code of practice” (July 18, 2025) (quoting Meta chief global affairs officer Joel Kaplan), available at https://techcrunch.com/2025/07/18/meta-refuses-to-sign-eus-ai-code-of-practice/. ↩

23. European Commission, Signatory Taskforce of the GPAI Code of Practice, available at https://digital-strategy.ec.europa.eu/en/policies/signatory-taskforce-gpai-code-practice; taskforce Vademecum (including participant list), available at https://ec.europa.eu/newsroom/dae/redirection/document/124170. ↩

24. California SB 53, Transparency in Frontier Artificial Intelligence Act, ch. 138 (approved Sept. 29, 2025), available at https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53. ↩

25. Texas HB 149, Texas Responsible Artificial Intelligence Governance Act (signed June 22, 2025; effective Jan. 1, 2026), adding Tex. Bus. & Com. Code ch. 552, including Secs. 552.052 (manipulation of human behavior), 552.056 (unlawful discrimination), and 552.057 (certain sexually explicit content and child pornography); bill history at https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149; enrolled text at https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm. ↩

26. New York S6953B (RAISE Act), ch. 699 (signed Dec. 19, 2025), as amended by S8828, ch. 96 of 2026 (signed Mar. 27, 2026; effective date reset to January 1, 2027), available at https://www.nysenate.gov/legislation/bills/2025/S6953 and https://www.nysenate.gov/legislation/bills/2025/S8828. ↩

27. Colorado SB 24-205 (Colorado AI Act), available at https://leg.colorado.gov/bills/sb24-205; Colorado SB 26-189, Automated Decision-Making Technology (signed May 14, 2026; effective Aug. 12, 2026; developer documentation duties Jan. 1, 2027), available at https://leg.colorado.gov/bills/sb26-189. ↩