EU AI Act Transparency Rules Take Effect
On 2 August 2026, new transparency obligations under the EU Artificial Intelligence Act (“AI Act”) became applicable across the European Union. Under the Act’s transparency provisions, AI-generated or manipulated content must now be clearly and visibly labelled with machine-readable marks, and chatbots must disclose to users that they are interacting with AI rather than a human.
The European Commission has also been granted authority to fine providers of general-purpose AI models up to €15 million or 3% of global annual turnover, whichever is higher, for non-compliance. Separately, the AI Act’s high-risk system obligations, originally also due on 2 August 2026, were postponed to December 2027 and August 2028 under the EU’s “Digital Omnibus” reform package, which entered into force on 27 July 2026.
Netherlands Brings NIS2 Into National Law
The Dutch Cybersecurity Act, entered into force on 15 August 2026, transposing the EU’s NIS2 Directive into Dutch national law. The Act was approved by the Dutch Senate on 7 July 2026 and replaces the prior The new regime significantly expands the number of organisations subject to cybersecurity regulation in the Netherlands, from approximately 1,000 to more than 8,000. It covers public authorities and organisations operating across 18 sectors, including energy, healthcare, transport, drinking water and digital infrastructure. From day one, and with no transition period, in-scope organisations must register with the National Cyber Security Centre, meet a statutory duty of care around cybersecurity risk management, report incidents within 24 hours of becoming aware of them, and ensure board-level governance and training accountability.
California Data Brokers Must Begin Processing Deletion Requests
Beginning 1 August 2026, obligations under California’s Delete Act became enforceable against registered data brokers. More than 600 data brokers must now access the state’s Delete Request and Opt-Out Platform (“DROP”) at least once every 45 days, retrieve consumer deletion requests, and delete all matching personal information within 45 days. Brokers must also direct their own service providers and contractors to complete corresponding deletions. Non-compliance carries a fine of $200 per day for each unprocessed deletion request, meaning a backlog of even a modest number of requests can expose a broker to significant daily financial exposure.
ICO Reprimands ACRO Criminal Records Office Following Cyber Security Failings
The Information Commissioner’s Office (“ICO”) has formally reprimanded ACRO Criminal Records Office over cyber security failings left the personal information of up to 10,920 people potentially exposed - including national insurance numbers, passport and bank details, biometric data and criminal offence information.
A hacker accessed ACRO Criminal Records Office’s website and content management system between August 2022 and March 2023 and staged data for theft, although could not determine whether it was removed. The ICO found ACRO Criminal Records Office had not ensured clear responsibility for critical security updates, failed to maintain effective patch management, and did not adequately investigate security alerts. A reprimand rather than a fine was issued in light of mitigating factors, including network segmentation that contained the breach.
California AI Transparency Act Becomes Operative
California’s AI Transparency Act became operative on 2 August 2026 - delayed from its original 1 January 2026 date specifically to align with the EU AI Act’s transparency timeline. The law applies to “covered providers”: any person or entity that creates, codes, or otherwise produces a generative AI system with more than 1,000,000 monthly visitors or users that is publicly accessible within California.
Covered providers must now offer a free, publicly available AI-content detection tool, provide users the option to add a visible disclosure to AI-generated or AI-altered image, video, or audio content, and embed a hidden, machine-readable provenance watermark where technically feasible. Civil penalties run to $5,000 per violation, with each day of non-compliance treated as a separate violation. Additional obligations for large online platforms and hosting providers are scheduled to phase in from 1 January 2027.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
