EU AI Act in 2026: Which Deadlines Moved—and Which Duties Did Not?
A dated owner’s map of the EU AI Act after the 2026 AI Omnibus, separating live transparency and GPAI rules from delayed high-risk duties.
European Union
Dated implementation radar
Regulatory Change Radar
Time-stamped, official-source explainers for EU and US requirements that can alter product, data, cyber and market-access decisions.
Which trigger, date or role determines whether this change reaches the business?
Scope triggerApplication dateRole mappingEvidence trail
Evidence cutoff: 12 August 2026. Read each article's status note and recheck its official sources before acting.
Start here
One useful entry point.
Begin with a representative mechanism, then use the grouped paths below to go deeper.
Design before pressure
Practical owner guides
Ransom-returned data is not an incident scope
A Canadian laboratory breach investigation shows why payment, returned data and regulator findings answer different incident questions.
Canada
A review response can disclose more than the complaint
A health-privacy settlement shows why reputation response authority should be separated from access to customer facts.
United States
Wildfire smoke can close an untouched workplace
California's workplace guidance shows how smoke, doors and ventilation can control operations far beyond an evacuation or damage map.
California, United States
The AI inventory that cannot explain its use case
A list of AI tools becomes more useful when it records the decision use, affected people, data path, owner and material-change triggers.
EU framework illustration and voluntary US institutional framework; applicability Not assessed
Can You Prove the Environmental Claim You Repeat?
A source-to-claim record for checking environmental statements received from suppliers before they reach products, sales material or customers.
United Kingdom with a United States comparison
The public signal was specific. The local conclusion was still missing.
A source-bounded guide to separating a public vulnerability signal from asset applicability, remediation choices, exceptions and recheck ownership.
General operational method informed by US institutional material; regulated-sector and reader-specific duties not assessed
The declaration existed. The question it invited had not been answered.
A UK-source-bounded guide separating section 54 framework facts from entity, group and supplier evidence questions that remain unassessed.
United Kingdom source context only; entity, group, turnover calculation, UK-business, evidence adequacy, compliance and forced-labour conclusions unassessed
Check the live trigger
Dated regulatory radar
A configuration error exposed sensitive HR dossiers to dozens of managers
A Hamburg regulator's retailer decision shows how access configuration, retention, and sensitive workplace notes can become one connected governance problem.
Germany
Background GPS continues after the app is closed
Canadian privacy findings involving an app's background location collection show how an abandoned business plan can leave a live data practice behind.
Canada
Mobile consent design became a EUR50 million case
CNIL's platform provider decision shows why layered notices and consent design can become the practical object of regulatory scrutiny, not a footer detail.
France / European Union
A hidden spreadsheet tab turned redaction failure into a safety problem
An ICO penalty notice shows how a hidden spreadsheet tab turned a redaction mistake into a safety and workforce problem.
United Kingdom (Northern Ireland)
Voice deletion promises conflict with model training
A voice-assistant order shows why a deletion request may have a different technical meaning once children's voice and location data feed algorithmic systems.
United States
A battery passport is not a supplier spreadsheet
A battery-passport project needs a governed product and lifecycle data path, not a supplier file detached from category, version and correction authority.
European Union battery framework; category and role Not assessed
Digital product passports begin as data ownership questions
Before treating a data carrier as the solution, map which product rules apply and who creates, validates, updates and corrects each data element.
European Union framework; product-specific scope Not assessed
DORA's subcontracting question: which critical service actually moves?
A DORA-related subcontracting map should connect an ICT service to its function, sub-provider, change route and exit dependency without assuming every vendor is in scope.
European Union financial-sector framework; entity, service and criticality scope Not assessed
The Digital Identity Wallet Question: Who Becomes the Relying Party?
A regulatory-radar guide to mapping role, purpose, user journey, requested attributes, evidence, data boundaries and change governance before integration.
European Union framework; Member State rollout, role and sector treatment not assessed
NIS2 supply-chain risk is not a vendor questionnaire
A supplier questionnaire can inform a NIS2-related review, but scope, supplier criticality, evidence, ownership and national implementation remain separate questions.
European Union directive framework; national law and entity scope Not assessed
Packaging Data: When a Sustainability Claim and a Product File Diverge
A source-aware method for connecting packaging facts, supplier statements, public wording, product versions and review decisions without claiming substantiation.
European Union framework example; product, market, date and claim treatment not assessed
The product changed after sale. The product file did not.
An EU-source-bounded analysis separating PLD liability from CRA cybersecurity while preserving version, evidence and unresolved product questions.
European Union source context only; product, role, market, national implementation, safety, defect, conformity, liability, reporting and recall outcomes unassessed
EU CBAM Definitive Phase: The 50-Tonne Threshold Is Not a Shipment Exemption
A 2026 CBAM trigger map for EU importers, covering the definitive phase, the annual 50-tonne threshold, authorisation and the first declaration.
European Union
EU CSDDD After the 2026 Simplification: Scope, Supply Chains and Timeline
A current CSDDD map after Directive (EU) 2026/470, separating the new thresholds and 2029 application date from supplier-request pressure.
European Union and Member State implementing laws
EU Deforestation Regulation: Scope and Deadlines After the 2025 Changes
A current EUDR trigger map for operators, traders and downstream businesses, including the December 2026 and June 2027 application dates.
European Union
EU GPSR for Online Sales: Product Listings Are Part of the Safety File
A practical General Product Safety Regulation map for online sellers, importers and marketplaces, covering listing data, responsible persons and evidence.
European Union
EU Packaging Regulation: What Applies Now and What Waits Until 2028–2030
A dated PPWR milestone map for packaging manufacturers, importers, brands and online sellers after the Regulation’s 12 August 2026 application date.
European Union
Corporate Transparency Act BOI in 2026: U.S. Companies Are Exempt
A current FinCEN BOI map separating the operative March 2025 rule from the August 2026 final rule awaiting Federal Register publication.
United States — federal
European Accessibility Act: What E-Commerce SMEs Should Check Now
A scoped guide to the European Accessibility Act for consumer e-commerce, including the service microenterprise exemption and national-law limits.
European Union and Member State implementing laws
EU Cyber Resilience Act: The 2026 Reporting Clock and 2027 Readiness
A practical CRA preparation map for digital-product businesses, separating September 2026 reporting from the December 2027 main obligations.
European Union
EU Data Act: Connected-Product Data and Cloud Switching in 2026
What business owners should verify under the EU Data Act now, before the connected-product design and cloud switching milestones arrive.
European Union
US Privacy and Cyber in 2026: Build a Trigger Map, Not One Checklist
A business-owner map of selected U.S. federal and state privacy and cyber triggers, including California’s 2026 rules and DROP duties.
United States — selected federal, California and Texas authorities
Supplier Change Control: Sanctions, Export, Tariff and Logistics Blind Spots
A practical change-control design for supplier, origin, ownership, routing and payment shifts that can alter trade risk after onboarding.
Cross-border trade, with selected United States authorities
UFLPA Import Risk: Can Your Supply Chain Produce Shipment-Level Proof?
A practical UFLPA evidence map for U.S. importers, covering the rebuttable presumption, traceability records, supplier controls and detention readiness.
United States