> ## Content Index > Fetch the complete content index at: https://www.thedecisionlayer.online/llms.txt > Use this file to discover other available public pages before exploring further. # Regulatory Radar™ — What moved, and what it obliges you to do. - URL: https://www.thedecisionlayer.online/what-moved-and-what-it-obliges-you-to-do/ - Published: 2026-08-25T05:58:20.000Z - Updated: 2026-08-26T06:41:33.000Z - Description: The August regulatory position on Article 50 transparency, AI-generated content marking, expanded AI Office supervision, training-data provenance and the obligations landing before year-end. - Author: Maman Ibrahim - Tags: Regulatory Radar, EU AI Act, AI Governance, Financial Services, #decision-layer-compass, #intelligence-edition 5-minute executive briefing · The Decision Layer™ Regulatory Radar · Week 4Executive update # What moved, and what it obliges you to do. The month's regulatory, supervisory, and policy movement, filtered to what changes an obligation, a date, or an expectation. Developments that change none of the three are left out. PublishedTue 25 August 2026 Read time5 minutes CycleWeek 4 of 4 Clock as at25 August 2026 01 · Clock update Carried forward from the Issue 01 dashboard and recalculated to the publication date. Shaded rows are live or fall inside one hundred days. | Date | Obligation / milestone | Remaining | Change | | ---------- | ----------------------------------------------------------------------- | --------- | -------- | | 2 Aug 2026 | Article 50 transparency obligations | Live | In force | | 2 Aug 2026 | Commission enforcement powers for GPAI obligations | Live | In force | | 2 Dec 2026 | Article 50(2) marking / detection transition for pre-2 Aug systems ends | 99 days | New | | 2 Dec 2026 | New Article 5 prohibitions apply | 99 days | New | | 2 Dec 2027 | Annex III standalone high-risk requirements | 464 days | Deferred | | 2 Aug 2028 | Annex I high-risk requirements for regulated products | 708 days | Deferred | August has separated the calendar into three categories: obligations already enforceable, a narrow transition ending in 99 days, and high-risk requirements that have moved materially outward. The delivery plan should now reflect those distinctions. 02 · Three developments ### One · The high-risk deferral is settled. Rebaseline, do not pause. **What moved** Regulation (EU) 2026/1744 entered into force on 27 July. Annex III high-risk requirements now apply from 2 December 2027, while Annex I high-risk systems embedded in regulated products move to 2 August 2028\. The same Regulation also reframed Article 4: providers and deployers must take measures to support AI literacy rather than guarantee a specific level for each individual. **What it obliges you to do** Rebaseline the programme, classifications, control build and funding. Do not treat the deferral as permission to stop inventory, ownership or evidence work. For AI literacy, revisit policies written against the previous wording and retain a defensible rationale for the measures taken by role and context. **Supervisory implication** A programme still carrying the old dates is stale. A programme that has stopped because the dates moved is equally difficult to defend. The useful question is whether the extra time is being converted into a more defensible operating position. F-ISRM · F-IoCR · CISSP · CISA · CRISC Regulatory Radar · The Decision Layer · Page 1 of 2 © 2026 DiamondSoul · Maman Ibrahim. All rights reserved. Reproduction prohibited without permission. 02 · Three developments, continued ### Two · Article 50 is live. The grandfathering is narrow. **What moved** Article 50 transparency obligations began applying on 2 August 2026\. Providers must address direct AI interaction and, where applicable, machine-readable marking of generated or manipulated content. Deployers have disclosure duties for specified uses including emotion recognition, biometric categorisation, deepfakes and certain AI-generated public-interest text. The 2 December grace applies only to Article 50(2) for qualifying systems already placed on the market before 2 August. **What it obliges you to do** Stop running one generic transparency workstream. Identify which live systems trigger interaction disclosure, content marking, deepfake disclosure, emotion-recognition or biometric-categorisation duties, and which legacy systems genuinely qualify for the limited transition. Where the voluntary Transparency Code is not used, retain evidence of the alternative measures relied upon. **Supervisory implication** The question has changed from “Are we preparing for Article 50?” to “Which systems are already subject to it, and can we demonstrate compliance today?” ### Three · Frontier AI has entered the financial supervisory conversation. **What moved** On 31 July, the EBA, EIOPA and ESMA called for a cross-sectoral, risk-based and consistent supervisory approach to ICT risks from frontier AI models. The statement emphasises prevention, detection and management, links the issue to existing governance and DORA oversight, and encourages financial entities and competent authorities to use it as a basis for supervisory dialogue. **What it obliges you to do** For EU financial entities, map where frontier models enter critical or important processes, including through suppliers. Identify the cyber scenarios that change because of frontier capability, correlated dependencies, detection requirements, ownership, fallback and the resilience testing that covers them. **Supervisory implication** This does not create a new DORA article. It changes the expected conversation around existing obligations. “DORA is implemented” is not a complete answer if the ICT-risk framework has not considered how frontier models change attack speed, dependency or concentration. 03 · Inside one hundred days | Date | Becomes binding | Function affected | | ---------- | ---------------------------------------------------------------------------------- | --------------------------------------------- | | 2 Dec 2026 | Article 50(2) marking / detection transition ends for qualifying pre-2-Aug systems | Product, engineering, legal, AI governance | | 2 Dec 2026 | New Article 5 prohibitions apply | Legal, trust & safety, product, AI governance | The next hard date is 99 days away. That is still inside the current planning cycle. Unresolved scope, ownership or funding decisions will increasingly determine whether delivery is possible on time. 04 · One question for the chair Which AI obligations are already live, which become binding before year-end, and where are we still relying on a programme date rather than an accountable owner and funded delivery plan? 05 · Sources Regulation (EU) 2026/1744, Official Journal of the European Union, 24 July 2026, in force 27 July 2026; Regulation (EU) 2024/1689 as amended; European Commission, Guidelines on Article 50 transparency obligations, 20 July 2026; EU AI Act Service Desk, implementation timeline and enforcement FAQs, current at 23 August 2026; EBA, EIOPA and ESMA, Joint Statement on ICT risks from frontier AI models, 31 July 2026\. Day counts calculated to 25 August 2026. Next in the cycle Board AI Risk Intelligence, Issue 02, Tuesday 1 September. Decision Signals, Tuesday 8 September. Maman Ibrahim · F-ISRM · F-IoCR · CISSP · CISA · CRISC Regulatory Radar · The Decision Layer · Page 2 of 2 © 2026 DiamondSoul · All rights reserved. Reproduction prohibited without permission.