Monthly regulatory brief · August 2026 edition
What changed, why it matters, what to do next
A curated monthly read for non-specialists: the moves in the EU AI Act and ISO 42001 world, the "so what" for your controls, and the next action. Verified against first-party sources — estimates are labelled.
Available to subscribers in English, Korean, Japanese and Chinese.
Art. 50 transparency is in force — hard deadline 2 Dec 2026
Enforcement began 2 Aug 2026 (Commission AI Office + national authorities). The transparency obligations apply from 2 Dec 2026: chatbot disclosure, machine-readable marking of synthetic content, and deepfake labelling. Industry sign-up to the voluntary transparency Code of Practice has been broad.
So what →
Confirm your chatbot and synthetic-content disclosures now. Deployer checklist →
High-risk obligations shifted (Board final approval 29 Jun 2026)
Standalone high-risk AI systems now 2 Dec 2027; high-risk embedded in regulated products 2 Aug 2028; regulatory sandboxes 2 Aug 2027. Nudifier / CSAM-deepfake prohibitions hold at 2 Dec 2026.
So what →
More runway for high-risk conformity work — but transparency and prohibitions are the near-term pressure.
ISO 42001 is becoming a procurement baseline
Industry reporting through mid-2026 notes that SOC 2 / PCI are increasingly seen as insufficient for AI assurance, with some banks and asset managers naming ISO 42001 and the NIST AI RMF in RFPs. Relatively few AI vendors are certified to ISO 42001 yet, so early movers still stand out — an optional differentiator today that is trending toward a contractual requirement tomorrow.
So what →
If you sell to regulated buyers, 42001 readiness is turning into a deal requirement, not a nice-to-have.
SME / small-mid-cap simplification may widen
Analyst commentary suggests simplification could extend to organisations up to ~750 staff / ~€150M. Labelled as an estimate: not itemised in the 29 Jun 2026 Board text we reviewed — treat as analyst-reported until confirmed in primary sources.
So what →
Watch for the primary text; don't plan around it yet.