The AI Act Was the Softer Law in Italy’s Deepfake Ruling

Italy’s Garante ruled against a broadcaster over AI-manipulated video of a named journalist on 23 July 2026, ten days before the AI Act’s transparency duties began to apply, and announced it two weeks later. The finding was made under Articles 5 and 25 of the GDPR, which have been applicable since May 2018. The videos did carry warnings about their artificial nature. The regulator held those warnings were not clear, evident or comprehensible enough for viewers, and issued an admonishment against R.T.I. S.p.A. plus a ban on further use of Enrico Mentana’s data, with no fine attached.

Our read is that probably this is where AI content enforcement will keep landing. Data protection authorities have eight years of practice, a complaint form that already works and a budget approved last year. Most member states have not yet named their AI Act market surveillance authority, and when they do, it will be short-staffed for two years. If you are mapping where your AI risk actually sits, put it on the DPA line.

Labelling Your Deepfake Does Not Buy You the Right to Use the Face

Article 50(4) of the AI Act provides that deepfakes that evidently form part of artistic, creative, satirical, or fictional works are subject to a lighter disclosure regime, under which the disclosure may appear in accompanying material rather than across the frame. Striscia la Notizia is satire. In our assessment R.T.I. would have had the easier ride under the law that had not yet applied. Article 50 governs the form of your label. It does not decide whether you may depict a named person saying things they never said, and it expressly leaves personality and privacy rights alone. That question stayed with the GDPR, which reaches AI content only when the content carries personal data, so a synthetic landscape or a generated product description sits outside all of this. The four Article 50 duties are worth getting right on their own terms, and they are not a safe harbour from anything else.

The start of the case happened when the Garante acted on Mentana’s own complaint, not on its own initiative. One annoyed person is enough, and that is a cheap trigger to pull. The person whose face you used does not need a lawyer, a budget or a theory. They need a web form.

PFAS Stock in Your Warehouse Has No Sell-Off Period

The first substantive PPWR requirements applied from 12 August 2026 and reach manufacturers, importers, distributors and online sellers directly in all 27 member states. Food contact packaging cannot go on the EU market at or above 25 ppb for an individual PFAS, 250 ppb for the sum of PFAS, or 50 ppm including polymeric PFAS. The Commission guidance of 5 June settled the warehouse question. There is no stock exhaustion period. Packaging already placed on the market before 12 August may stay there, but stock manufactured in July and placed on the market in September is caught. The same guidance concedes there is no harmonised test method and recommends a stepwise approach, which is a prohibition and a shrug arriving together.

Dutch NIS2 Gives Boards Two Years to Train and Everyone Else No Grace at All

The Cyberbeveiligingswet and the Wet weerbaarheid kritieke entiteiten both took effect on 15 August 2026, against an original transposition deadline of 17 October 2024. More than 8,000 organisations must register in the entity register at the NCSC, meet the duty of care, and report significant incidents within 24 hours, with a follow-up at 72 hours and a final report within a month. Mandatory board training carries a transition of up to two years. Nothing else does. Supervision is split across sector regulators rather than run by the NCSC, so the entity that registers you is not the entity that fines you. A company established or supplying digital services in the Netherlands falls under the Cbw directly, and everyone else meets it through supplier clauses, since the duty of care covers supply chain risk.

Less Important this Month

CBAM headlines about the definitive regime describe nothing you can file in 2026. The first annual declaration and certificate surrender for 2026 imports fall on 30 September 2027, and certificates go on sale on 1 February 2027. What is live is measurement, because the embedded emissions in everything you import this year set the certificate bill you pay in 2027, and the 31 March 2026 date that passed was the bridge letting you keep importing while your authorisation is processed, not the closing of applications.

CSRD anxiety is aimed at companies that mostly left scope in February. Under Directive (EU) 2026/470, reporting is limited to more than 1,000 employees and more than €450 million net turnover, both required, replacing a two-of-three test at 250 employees, €50 million turnover and €25 million balance sheet. That change applies to financial years beginning on or after 1 January 2027. For financial years starting in 2025 and 2026, member states may exempt companies below the new thresholds, and that option is national and not automatic, so a first-wave company in a state that declined it still reports.

Both Deadlines Reach What You Already Sell or Already Run

18 August 2026. The e-Evidence Regulation becomes applicable in every member state except Denmark. Hosting, cloud, marketplaces and any service letting users communicate must have designated an establishment or appointed an EU legal representative. A European Production Order runs to 10 days, or 8 hours in emergencies, and the Regulation caps penalties at 2% of worldwide annual turnover while leaving the amounts to national law. The Commission sent letters of formal notice to 22 member states on 27 March for missing the transposition deadline.

11 September 2026. Cyber Resilience Act reporting starts for manufacturers of products with digital elements. An actively exploited vulnerability means an early warning within 24 hours and full notification within 72. Products already on the market are covered, which is the part most product teams have missed.

Three of the dates in this issue arrived late or without the national machinery behind them. Regulator delay is not a shield. The application date does not move because your supervisor is not ready, and all the delay changes is who you report to, which is an administrative problem rather than a legal one. The high-risk clock is stopped until 2 December 2027, so classification tells you which duties bind you today and which sit on a paused timer. Run your systems through the AI Act Risk Classifier and find out which of the two you are looking at.