EU AI Act Weekly Radar: transparency duties advance as implementation timelines shift and cyber oversight hardens

The past week brought a more concrete picture of where EU AI Act implementation is heading: some obligations are getting operational fast, while other headline deadlines may be moving further out.

For legal, product, and governance teams, the key message is not simply that the timetable is changing. It is that the EU’s implementation posture is becoming more differentiated. Transparency obligations appear to be moving into immediate execution mode; potential timing changes for high-risk systems could reshape programme sequencing; and regulators are linking frontier AI more directly to cybersecurity supervision and testing capacity.

1) Transparency obligations are becoming an immediate compliance priority

The clearest near-term signal came from the AI Act Service Desk, which added the “Code of Practice on Transparency of AI-Generated Content” as a policy resource on 2 July 2026 and paired it with a signing webinar. According to the Service Desk entry, Article 50 duties on marking, detection, deepfake labelling, and certain public-interest text disclosures apply from 2 August 2026, with signatories to be listed in July 2026.

That matters because it suggests the transparency layer of the AI Act is no longer a distant documentation exercise. It is becoming an operational readiness issue. Organisations likely to be affected should be thinking in terms of product controls, UI disclosures, content handling rules, detection capabilities, internal ownership, and evidence trails showing how obligations are being implemented in practice.

In practical terms, this is the kind of development that tends to accelerate three internal workstreams at once:

• Product design, especially where systems generate or transform content for end users;
• Governance and policy, including standards for labelling, disclosure, and escalation; and
• Auditability, meaning logs, testing records, and accountability for how transparency measures are applied.

The Service Desk update also indicates that the Commission-side ecosystem is trying to make compliance legible through supporting materials and public signalling around signatories. Even without treating the code itself as a substitute for the legal text, the move is a useful indicator of implementation priorities and of the kinds of behaviours regulators may expect to see documented early.

2) The Digital Omnibus could materially reorder high-risk AI compliance timelines

A second major development came from DLA Piper’s update on the Digital Omnibus on AI, published on 2 July 2026. That update says the proposal keeps the AI Act’s basic structure but resets parts of the implementation timetable.

On that account:

• Annex III high-risk systems would move to 2 December 2027;
• Annex I product-safety AI would move to 2 August 2028;
• new bans on non-consensual intimate content and CSAM tools would apply from 2 December 2026; and
• some legacy Article 50(2) systems would receive a later date.

If that reading holds, it is strategically significant. For many organisations, Annex III scoping and Article 6 analysis have been central to 2026 and 2027 planning. A later compliance date would not remove the need for classification work, governance design, or technical controls. But it could change the order in which teams spend time and budget.

The likely effect would be a sharper split between what still needs urgent implementation and what may move into a longer build cycle:

What still looks urgent

• Article 50 transparency readiness;
• monitoring of new prohibitions and content-related restrictions;
• governance for GPAI and advanced-model risk evidence;
• contract and procurement updates where deployers need provider assurances.

What may shift into phased delivery

• full Annex III high-risk control implementation;
• product-safety AI conformity planning tied to Annex I;
• longer-horizon redesign of quality management, post-market monitoring, and technical documentation stacks.

For lextrace readers, the important point is that this is not just a calendar issue. It affects how to structure compliance programmes. If the timetable is indeed being reset, organisations should avoid overcommitting resources to a single all-at-once high-risk programme while underinvesting in the obligations that are still arriving on near-term dates.

3) The enforcement conversation is becoming more operational for advanced AI and GPAI

The European Commission’s 7 July announcement on a new EU plan to address the risks and opportunities of advanced AI for cybersecurity adds a different but related signal. The Commission says advanced AI models must be evaluated and their risks assessed before placement on the EU market, and that it will help build EU evaluation capacity, structured access arrangements, and testing infrastructure to support the AI Office’s regulatory role.

This is important because it shows the AI Act is not being implemented only through static guidance or abstract duties. The Commission is also describing the institutional and technical infrastructure needed to make oversight real.

For frontier-model and GPAI teams, that points toward a compliance environment in which regulators will increasingly expect evidence, not just policies. That can include:

• pre-market evaluation records;
• risk assessment methodologies;
• testing environments and reproducibility processes;
• controlled access arrangements for review or assurance; and
• clearer documentation showing how safety and cybersecurity concerns were assessed before release.

Even where the source does not provide all operational details, the direction is clear: evaluation capacity is becoming part of the regulatory architecture. That should matter to companies building, adapting, or integrating advanced models, especially if they have assumed that AI Act oversight would remain largely documentation-driven in the short term.

4) Financial supervisors are connecting AI risk to resilience expectations

The supervisory signal strengthened further on 7 July, when the European Supervisory Authorities supported an ESRB warning on systemic cyber risks from frontier AI models. In the European Banking Authority release, the ESAs say that existing frameworks, including DORA and the AI Act, provide a base, but that supervisors are working with national authorities to clarify expectations because the speed and scale of AI-enabled attacks could challenge operational resilience.

This matters beyond financial services.

First, it confirms that the AI Act is already being read alongside sector-specific regimes rather than in isolation. Second, it shows that national and sector supervisors are likely to translate broad AI governance duties into more concrete expectations around resilience, controls, and testing. Third, it suggests that the compliance burden for AI deployment in regulated sectors may increasingly be shaped by the interaction between the AI Act and adjacent supervisory frameworks.

For firms in finance, or vendors selling into finance, the message is straightforward: AI governance cannot sit apart from cyber and operational resilience programmes. If frontier or advanced AI changes attack surfaces, failure modes, or response timing, supervisors will likely want to see those effects reflected in governance and assurance processes.

5) What this week means for Article 6 and Annex III planning

Although the week did not bring a standalone official AI Office guideline on Article 6 or Annex III, the combined updates still matter for those scoping exercises.

Why? Because Article 6 and Annex III classification work depends not only on the text of the Act, but on implementation timing, adjacent policy signals, and the likely sequencing of enforcement attention.

This week’s synthesis suggests a few practical implications:

A. Keep classification work moving, even if deadlines may shift

If the Digital Omnibus changes are confirmed, some teams may be tempted to slow down Annex III analysis. That would be risky. Classification decisions often drive procurement language, system inventories, governance ownership, and architectural choices. A later date can justify reprioritisation, but not abandonment.

B. Separate scoping from full-stack implementation

A sensible response may be to continue Article 6 and Annex III scoping now, while staging more resource-intensive build work over a longer period if the new timelines are confirmed.

C. Expect sectoral pressure to continue even where AI Act dates move

The ESA and Commission signals show that cyber, resilience, and advanced-model oversight may continue to develop regardless of whether some high-risk dates are postponed. In other words, a slower Annex III clock would not necessarily mean a lighter supervisory environment.

6) A practical reading for providers, deployers, and SMEs

For readers trying to translate this week into action, the easiest mistake is to treat all AI Act obligations as moving at the same speed. This week suggests the opposite.

Providers

Providers should prioritise near-term transparency readiness, especially where systems generate synthetic or transformed content. At the same time, advanced-model providers should pay close attention to evaluation, testing, and risk assessment expectations emerging from the Commission’s cybersecurity plan.

Deployers

Deployers should revisit vendor diligence and contract terms. If transparency obligations are imminent, deployers may need clearer assurances about labelling, detection support, logging, and incident handling. In regulated sectors, they may also need to align AI deployment decisions with resilience and cybersecurity controls already governed by other regimes.

SMEs and startups

For SMEs and startups, the likely lesson is sequencing. The combination of a possible high-risk timing reset and a firm transparency timetable may support a more focused compliance roadmap: first address obligations that are becoming operational now, then stage heavier high-risk implementation work as legal timing becomes clearer. That said, smaller organisations still need system inventories and classification discipline, because late scoping usually creates expensive remediation later.

7) The bigger pattern: the AI Act is becoming a layered implementation regime

Taken together, this week’s updates point to a layered model of implementation:

1. Immediate operational duties are crystallising around transparency.
2. Core high-risk obligations may be subject to timetable recalibration.
3. Advanced-model oversight is becoming more evidence-based through evaluation and testing infrastructure.
4. Sector supervisors are starting to translate AI risks into resilience and cyber expectations.

That is a more complex picture than a single countdown to one compliance date. But it is also a more realistic one. Organisations that distinguish between these layers will be better placed than those still treating the AI Act as one monolithic project.

Bottom line

This week’s radar does not point to a pause in AI Act implementation. It points to a redistribution of pressure.

The pressure is rising fastest around Article 50 transparency execution, around evaluation and risk evidence for advanced AI, and around sectoral cyber-resilience expectations. At the same time, the reported Digital Omnibus changes could give organisations more time on some high-risk obligations tied to Article 6, Annex III, and Annex I.

For lextrace readers, the practical takeaway is to re-sequence, not relax: keep classification and governance design moving, but shift immediate attention to the obligations and supervisory themes that are becoming operational first.