AI Content Labels Become Mandatory 2 August

Last month’s Digital Omnibus delay bought you 16 extra months on high-risk AI classification. The transparency half of the AI Act did not flinch. The Commission published the Code of Practice for marking AI-generated content on 10 June, and Article 50 obligations become binding on 2 August 2026.

Article 50 Content Labelling Becomes Binding 2 August

The Code of Practice sets out machine-readable markers, imperceptible watermarks for images and audio, digitally signed provenance records, and optional EU icons for deepfakes.

If you build AI systems that generate text, images, or audio, Article 50(2) requires you to embed these labels by 2 August. If you deploy third-party AI tools, the labelling obligation sits with your vendors. Your job as deployer is narrower. Do not strip the labels, and disclose AI-generated content you publish on matters of public interest.

Enforcement in the first 6 to 12 months will likely be selective. The system is still catching its breath. The Article 50 guidelines were in public consultation as recently as May 2026. You cannot rigorously enforce rules whose implementing guidance was finalised weeks before the deadline. In our read, regulators are not looking the other way. They simply do not have the machinery running yet. A regulator who does knock will want a reasonable plan, vendor responses, and a clear decision about what you label now versus what comes with the December deadline.

The practical step is the same whether you build or deploy. Check whether your AI vendors have communicated their Article 50 readiness.

CBAM Absorbs 180 Downstream Products

ECOFIN adopted its general approach on expanding CBAM to downstream products on 12 June. The current regime covers steel, aluminium, cement, fertilisers, electricity, and hydrogen. The proposed expansion adds roughly 180 steel- and aluminium-intensive finished goods, from machinery to household appliances. The target date is 1 January 2028. In our assessment, if you import anything with significant embedded steel or aluminium, start mapping HS codes against the proposed list now. Building emissions data collection from suppliers takes longer than the 18 months you think you have.

€1.85 Million for One Checkbox

Norway’s Datatilsynet fined Elkjøp 20 million NOK (approximately €1.85 million) for cramming six million loyalty club members’ consent into a single all-or-nothing tick. The consent was not specific, not freely given, and not informed. Uploading member data to advertising platforms via Customer Match without a separate compatibility assessment earned a second violation. The fine is not yet final, but in our assessment, the template is.

If you run a loyalty programme, did you also cram everything into one checkbox?

CSRD Scope Down 88% After Omnibus I

EFRAG confirmed that Omnibus I cut non-EU companies in CSRD scope from roughly 10,000 to 1,200. 88% fewer companies in a single legislative package. Brussels does not do things by halves. Except, apparently, when it does exactly that.

CRA Chapter IV entered into force on 11 June, triggering the conformity assessment body notification process. The Commission filled the AI Act oversight chairs by standing up the Scientific Panel and Advisory Forum on 1 June. Bulgaria’s NIS2 transitional period expired the same day.

Personal fines for board members now apply at full statutory rates. €5,000 per individual. Enough to sharpen attention at the next board meeting.

Dates to Watch

NIS2 national transposition is accelerating. The Netherlands expects its Cyberbeveiligingswet on 1 July. Luxembourg requires self-registration with the ILR by 10 July. If you operate in either jurisdiction and have not registered, both carry personal liability for board members.

AI Act Article 50 content labelling becomes binding on 2 August.

CRA Article 14 vulnerability reporting starts on 11 September. From that date, any actively exploited vulnerability in your product requires a 24-hour early warning to ENISA or your national CSIRT.