This cycle was dominated by Europe: the AI Act Omnibus is now in force, a transparency deadline is days away, and the promised high-risk registry has slipped. Meanwhile US states are digging in against a proposed federal freeze, and new guidance keeps drawing a line between testing AI and proving it. Here is what changed and what to do about it.
EU AI Act Omnibus is now in force
The Digital Omnibus on AI has entered into force, according to the European Commission and law firm Lewis Silkin. Coverage from Tech Times points to a transparency deadline arriving within days and further restrictions dated to December.
Why it matters: “In force” is not “figured out.” If you deploy generative or user-facing AI touching the EU, the transparency obligations are the immediate exposure. Map which systems disclose AI involvement to users and label AI-generated content, and keep the evidence of that labeling, not just a policy that says you do it.
Transparency, high-risk classification, and a slipping registry
Guidance on the transparency obligations, including scope and timeline, is now available from firms such as Stibbe, while CoinGeek reports the EU issued a transparency guide ahead of August enforcement. Separately, Mondaq reports the Commission opened public consultation on draft guidelines for classifying high-risk AI systems. At the same time, Euractiv reports the EU’s high-risk AI database has been pushed to mid-to-late 2027.
Why it matters: The obligations are landing before the infrastructure and the classification lines are settled. Do not treat the registry delay as breathing room. The safer read is that classification and documentation expectations arrive first and the central database catches up later, so build your high-risk determination and technical documentation now while the criteria are still in draft. That is exactly the AI validation work that gets skipped when teams wait for a portal to tell them what to file.
On the standards side, SecurityBrief Asia reports that BSI has set an AI quality standard aimed at EU high-risk systems.
Why it matters: A recognized quality standard gives auditors a concrete yardstick. If you are building toward high-risk conformity, aligning your quality management evidence to an emerging standard beats inventing your own criteria and defending them later.
US states versus a proposed federal freeze
According to Startup Fortune, Congress is weighing a three-year freeze on state AI laws, and state lawmakers, including those behind measures like the Colorado AI Act, are resisting.
Why it matters: Betting on preemption is a bad compliance strategy. Until a freeze actually passes, the operating assumption for multi-state operators should be that state obligations stand. Build to the strictest regime you touch and you are covered either way.
Governance: evaluation is not certification
A formal analysis covered by Tech Times makes the case that AI safety evaluations do not amount to safety certificates. In a related vein, heise online reports that SAP customers running the Joule assistant still have compliance work to do that the deployment itself does not resolve.
Why it matters: This is the throughline of the whole cycle. Passing an eval, or turning on a vendor’s AI feature, is a data point, not proof of fitness for your use and your risk. The evidence that survives an audit is a validation record tied to your intended use, your data, and your controls. Validated, not just documented, applies as much to a purchased assistant as to a model you build.
A quiet cycle for medical device AI, but the EU clock is loud. If you operate high-risk or user-facing AI, spend the next two weeks on transparency evidence and high-risk classification, not on waiting for the registry.
See how we validate AI systems →
Until the next cycle,
The Third Penguin