AI Regulation and Policy (state at 2026-10-01)

Verification (2026-10-02)

The European Commission’s AI Act page and AI Act Service Desk timeline (primary) confirm: AI Omnibus in force 27 July 2026; prohibitions 1 to 8 since 2 Feb 2025 and a ninth (non-consensual intimate content and child abuse material, introduced by the Omnibus) from December 2026 (service desk: 2 Dec 2026, with a transition period for certain providers’ content-related obligations); GPAI obligations since 2 Aug 2025; general application and enforcement from 2 Aug 2026; sandboxes 2 Aug 2027; Annex III high-risk 2 Dec 2027; Annex I 2 Aug 2028. White House EO 14365 (11 Dec 2025) and Colorado SB26-189 (signed 14 May 2026, effective 1 Jan 2027) were confirmed on the official sites. The regulation number 2026/1744, adoption date and Official Journal date still rest on EUR-Lex listings seen via search and law-firm notes: the EUR-Lex text did not load. Quote article wording from the Official Journal before relying on it legally. Not legal advice.

EU AI Act (Regulation (EU) 2024/1689) after the Digital Omnibus

The “Digital Omnibus on AI”, Regulation (EU) 2026/1744, amends the AI Act (plus the EASA and Machinery regulations). Path: political agreement May 2026, European Parliament vote 2026-06-16, Council final approval 2026-06-29, adopted/signed 2026-07-08, published in the Official Journal (L series) 2026-07-24, in force 2026-07-27 (six days before the original 2026-08-02 high-risk date).

DateWhat applies
2025-02-02First eight prohibited practices (social scoring, workplace emotion recognition, untargeted face scraping…) and the Art. 4 AI literacy duty (softened by the Omnibus, see below)
2025-08-02General-purpose AI (GPAI) obligations: transparency, copyright policy, documentation; governance
2026-08-02AI Office and Member States start enforcing; GPAI fines possible (up to 3% of turnover or EUR 15m per the Act; not rechecked in the primary text); Art. 50 transparency (label AI-generated content, deepfakes, AI interaction disclosure)
2026-12-02New ninth prohibition: AI generating non-consensual intimate imagery and CSAM; marking/detection grace period ends for generative systems already on the market before 2026-08-02
2027-08-02Member State regulatory sandboxes (postponed); GPAI models placed on the market before 2025-08-02 must comply
2027-12-02Annex III stand-alone high-risk systems (biometrics, critical infrastructure, education, employment, migration, etc.), moved from 2026-08-02
2028-08-02High-risk AI embedded in products under sector law (Annex I: lifts, toys, machinery…)

AI literacy (Art. 4): retained but softened. Providers and deployers must “take measures to support the development of AI literacy” of staff (previously: ensure, to their best extent, a sufficient level); the text adds that this does not require guaranteeing any specific level for any individual, and tasks the Commission and Member States with supporting SMEs. (Wording per law-firm analyses (lawandtechnology.eu, Freshfields) of the final text; earlier tracker sources that said the duty was dropped or unchanged are superseded.)

Also changed: SME simplifications extended to small mid-caps; the AI Office gains supervision over AI systems built on a GPAI model from the same provider; registration is reinstated for self-assessed “not high-risk” systems.

What matters for a Belgian user

  • Belgium has not (as of mid-2026 tracker sources; nothing newer found) enacted an AI Act implementing law. The 2025-2029 federal government agreement (per the regulatoryai.eu tracker; not verified against the agreement itself) names BIPT/IBPT as lead market-surveillance authority, with FPS Economy coordinating; the data protection authority (GBA/APD) covers personal-data aspects. Per the tracker, Belgium missed the 2025-08-02 authority-designation deadline; the BIPT role appears to be policy, not statute. Per the tracker, Belgium has no operational national AI sandbox yet (EU deadline now 2027-08-02 after the Omnibus); the FARI test hub in Brussels is described as a testbed (not verified).
  • Using tools (ChatGPT, Claude, Copilot) as a deployer: softened AI literacy duty (Art. 4) and Art. 50 transparency if you publish AI-generated content or run chatbots. Whether building on GPAI models makes you a GPAI provider depends on the Act’s definitions and Commission guidance; not verified here, seek legal advice.
  • GDPR still applies in parallel, see data-privacy-in-ai.

Other regimes (compact)

RegionStatus
US federalNo comprehensive AI statute. Executive Order 14365 of 2025-12-11 (White House) creates a DOJ AI Litigation Task Force to challenge state AI laws, tasks Commerce to list “onerous” state laws and FCC/FTC to start preemption proceedings. White House non-binding legislative recommendations 2026-03-20 urge preemption. A bipartisan House discussion draft (Obernolte, Trahan et al., June 2026) would preempt state model-development laws for 3 years; secondary reporting says it had stalled as of September 2026; on 2026-09-23 a bipartisan group of 26 state attorneys general urged Congress to regulate frontier AI without pre-empting state laws (secondary: regulatoryoversight.com), and a Senate frontier-AI bill was reported as still unreleased
US statesCalifornia SB 53 (frontier-model transparency; large developers must publish a frontier AI framework, penalties up to USD 1M per violation) effective 2026-01-01; New York RAISE Act signed 2025-12-19, effective 2027-01-01; Colorado’s AI Act was repealed and replaced by SB 26-189 (signed 2026-05-14, effective 2027-01-01, automated decision-making disclosure model)
UKNo AI Act. The May 2026 King’s Speech contained no AI bill; AI is handled via sector regulators (ICO, FCA, Ofcom) and sandboxes (AI Growth Lab via the Regulating for Growth Bill); AI Security Institute is not a regulator
South KoreaAI Basic Act signed 2025-01-21, in force 2026-01-22 (user notification, impact assessments for high-impact AI, domestic representative for foreign providers); a one-year grace period before fines (secondary sources)
JapanAI Promotion Act enacted 2025-05-28, fully in force 2025-09-01: soft law, no penalties or prohibitions (secondary sources)
Council of EuropeFramework Convention on AI opened for signature 2024-09-05; not in force until five ratifications (see ethics-in-ai)
ChinaLabelling Measures for AI-generated content and mandatory standard GB 45438-2025 in force since 2025-09-01; amended Cybersecurity Law with AI provisions in force 2026-01-01 (approved 2025-10-28).

What changed in 2026

  • EU: AI Act high-risk dates postponed (Annex III to 2027-12-02, Annex I to 2028-08-02); Art. 4 literacy softened; new Art. 5 ban on non-consensual intimate imagery/CSAM generation; Art. 50 grace for existing systems shortened to 2026-12-02.
  • US: Colorado rewrite; federal preemption push (EO 14365, stalled House draft).
  • UK: no AI bill in the 2026 King’s Speech.
  • China: Cybersecurity Law AI clauses in force.

Limits

The regulation number 2026/1744, adoption date and Official Journal date rest on the EUR-Lex listing and law-firm notes (the full text did not load); Art. 50 grace wording is per law-firm analyses (the Commission service desk confirms a December 2026 transition period); Belgian authority status is per the regulatoryai.eu tracker; California SB 53’s start date is confirmed by law-firm alerts and Wikipedia (2026-10-05); the stalled House draft is per secondary reporting (Nextgov, June 2026; TechPolicy.Press September 2026 via search); Korea and Japan rows are from law-firm and tracker pages, not the statutes. This note is not legal advice.

Sources (accessed 2026-10-02 unless noted)