Global Tech Policy Tracker — 2026-07-30

Top Story

EU's Digital Omnibus Delays High-Risk AI Rules, Tightens Restrictions on Harmful Content

The European Union's Digital Omnibus on AI (Regulation 2026/1744) entered into force on July 27, 2026, fundamentally reshaping the EU AI Act's implementation timeline while introducing new immediate prohibitions. The amendment pushes back the most burdensome compliance deadlines—high-risk AI obligations now don't apply until December 2, 2027 (originally August 2, 2026) and full enforcement moves to August 2, 2028. However, the amendment simultaneously imposes two new blanket prohibitions effective immediately: AI-generated non-consensual intimate images and child sexual abuse material (CSAM), with no grace period.

The change reflects a compromise between tech industry lobbying for more time and civil society demands for stronger safeguards against abuse. "The Digital Omnibus on AI was voted by the European Parliament on 16 June 2026 and entered into force on 27 July 2026," according to Spicy Advisory, marking a decisive moment in EU regulatory evolution. The amendment also clarifies AI literacy obligations—converting absolute requirements into "obligations of effort"—and introduces two new prohibited practices targeting deepfakes and synthetic media.

For companies, the timeline reprieve is significant but conditional. While large language models and frontier systems gain breathing room on transparency and documentation, the immediate prohibition on intimate image synthesis and CSAM means deployers must implement detection and removal systems now. EU penalties remain steep: €35 million or 7% of global annual turnover for prohibited practices, €15 million or 3% of turnover for high-risk violations. The fragmented timeline creates compliance complexity—vendors must address certain issues immediately while deferring others to 2027-28.

1 sources

spicyadvisory.com

spicyadvisory.com

New Legislation & Regulatory Actions

United States: 84 New AI Laws Enacted Across 27 States in 2026

• What happened: US states have collectively passed 84 new AI-specific laws through mid-2026, addressing chatbot safety, children's digital rights, medical authorization, consumer protections, and frontier model oversight. The Transparency Coalition's mid-year report shows AI regulation has moved from emerging policy to mainstream state compliance obligation.
• Who it affects: AI developers, healthcare platforms, educational tech providers, social media companies, and any firm deploying AI systems affecting minors or medical decisions in regulated states.
• Status: Enacted / ongoing—more state legislation expected by year-end 2026
• Why it matters: The fragmented state-by-state approach creates a patchwork compliance burden that federal legislation could streamline, but Congress remains deadlocked. Companies must now maintain compliance postures for 27+ different regulatory regimes.

EU: Immediate Prohibition on AI-Generated Intimate Images and CSAM

• What happened: The Digital Omnibus created two new absolute prohibitions on AI systems that generate non-consensual intimate images and child sexual abuse material, effective immediately with no transition period.
• Who it affects: Deepfake platforms, generative AI services, social media companies hosting user-generated content, and any provider offering image synthesis or manipulation tools.
• Status: Enforceable immediately (July 27, 2026)
• Why it matters: This is the first hard enforcement action under the EU AI Act and sets a precedent for rapid prohibition of AI harms. Companies must implement detection systems now or face fines.

US: FTC Policy Statement on AI Accuracy and Deceptive Practices

• What happened: The Federal Trade Commission issued a policy statement in July 2026 addressing how Section 5 of the FTC Act applies to companies marketing AI systems—specifically targeting deceptive claims about accuracy and capability.
• Who it affects: Any company making claims about AI system performance, chatbots marketed as human-like, and AI tools advertised with specific accuracy metrics.
• Status: Policy guidance issued; enforcement authority activated
• Why it matters: The FTC is signaling aggressive enforcement on false AI marketing claims, particularly claims about accuracy suppression or misleading capability descriptions.

1 sources

federalregister.gov

federalregister.gov

Enforcement & Penalties

• EU Regulator → Global Tech Companies: The EU AI Act penalty structure is now in effect. Violations of prohibited practices (non-consensual intimate images, CSAM) carry fines of €35 million or 7% of global annual turnover, whichever is higher. High-risk violations carry €15 million or 3% of turnover. Even US-headquartered companies operating in the EU face these penalties.

• US Congress → Stalled Federal AI Legislation: As of July 27, 2026, House members Obernolte and Trahan made a final bipartisan pitch for pre-midterm AI action, but Congress has largely failed to pass comprehensive federal AI legislation despite Republican control of the government. The lack of federal framework forces companies to comply with 27+ state regimes instead.

Industry Response

• Tech Companies & AI Developers: Compliance teams are urgently implementing deepfake detection and CSAM filtering to meet the July 27 EU deadline, even as they negotiate extended timelines for high-risk obligations. Vendors are updating AI governance frameworks to address state-specific requirements across the US, adding legal and technical overhead.

• Brookings Institution & Policy Experts: David Beier and Mark MacCarthy published a call for Congress to pass a new federal AI law on July 30, 2026, arguing that "a predictable, public, and accountable regulatory framework" is needed to replace the current patchwork. This signals growing pressure on lawmakers to act before midterm elections.

• EU AI Labeling Requirements: Starting August 2, 2026, companies must label AI-generated content and deepfakes under EU AI Act transparency rules. Experts warned in the Euronews report that "technical gaps and a lack of common standards could undermine enforcement," indicating voluntary industry compliance may fall short.

Region Scorecard

Analysis: What This Means

• Compliance Timeline Fragmentation: Companies now operate under three parallel deadlines—immediate EU prohibitions (deepfakes, CSAM), delayed EU high-risk obligations (December 2027), and 27+ separate US state regimes with varying deadlines. Budget for regional compliance teams and documentation systems that can support multiple regulatory postures simultaneously.

• Penalty Risk is Real and Imminent: The €35 million / 7% turnover EU penalty applies now to any company deploying AI systems in Europe. Even a single incident of non-consensual intimate image generation or CSAM synthesis could trigger investigation. Implement detection and audit systems immediately, not in 2027.

• Federal US Legislation is Unlikely Before 2026 Elections: Congress remains gridlocked, forcing US companies to navigate state-by-state compliance. Prioritize legal review of operations in high-regulation states (California, Illinois, Hawaii, Massachusetts, Colorado) and consider advocating for federal preemption to reduce fragmentation.

• AI Accuracy Claims Face FTC Scrutiny: The FTC's new policy statement signals enforcement against marketing claims about AI accuracy. Audit all customer-facing claims about model performance, accuracy rates, and human-like behavior. Marketing teams should coordinate with legal before publishing performance metrics.

What to Watch Next Week

• August 2, 2026 — EU AI Act Transparency Labeling Deadline: Companies must begin labeling AI-generated content and deepfakes or face non-compliance notices. Monitor EU official guidance for technical standards.

• US Congressional Recess & Campaign Season: With midterm elections approaching, federal AI legislation is unlikely to advance. State legislators may continue passing bills; watch for California, New York, and Texas announcements.

• First EU AI Act Enforcement Cases: Watch for early investigations into deepfake services and CSAM-related incidents. The EU Commission will likely issue guidance on investigation procedures within days.

Data Quality Note: This briefing draws exclusively from sources published between July 24–30, 2026. The EU Digital Omnibus timeline is confirmed via official sources (Spicy Advisory, Foley & Lardner, Politico). US state legislation figures come from the Transparency Coalition's mid-year report. Earlier policy frameworks and previously published legislation are excluded to maintain freshness.