AB 2013 training-data transparency, SB 53 frontier transparency (TFAIA), and the CPPA risk-assessment / ADMT / cyber-audit regulations all took effect.
Regulation (EU) 2026/1744 amended the AI Act: standalone high-risk duties deferred to 2 Dec 2027 and embedded-product duties to 2 Aug 2028 — but 2 Aug 2026 was left untouched.
Chatbots must disclose they are AI; synthetic audio/image/video/text must be machine-readable marked and detectable; deepfakes and AI-generated text on matters of public interest must be labelled. AI Office and national enforcement powers switch on the same day.
Systems already on the market before 2 Aug 2026 get until this date for the marking-and-detection duty ONLY. Chatbot disclosure and deepfake labelling had no grace period at all.
Colorado SB26-189 developer documentation duties begin, and California CPPA ADMT requirements for significant decisions apply.
Chapter III obligations for Annex III standalone high-risk systems apply — deferred ~16 months by the Digital Omnibus.
Annex I embedded-product high-risk obligations apply.
| Article | The duty | What you actually build | Grace? |
|---|---|---|---|
| Art 50(1) | Tell people it is AI | A persistent, unmissable disclosure in any chat surface — not buried in ToS. Applies from 2 Aug 2026 with no grace period. | none |
| Art 50(2) | Mark synthetic output machine-readably | Embed provenance in generated media/text (e.g. C2PA-style manifests, watermarks) so it is detectable downstream. This is the one duty with a legacy grace period — to 2 Dec 2026 — for systems on the market before 2 Aug 2026. | to 2 Dec 2026 |
| Art 50(3) | Notify emotion-recognition / biometric categorisation | Explicit notice to exposed individuals before processing. | none |
| Art 50(4) | Label deepfakes and public-interest AI text | Visible labelling on deepfakes and on AI-generated text published on matters of public interest. No grace period. | none |
| Control | What it does | Request shape | Status here |
|---|---|---|---|
| Zero data retention | Force endpoints that do not store prompts or completions. | provider.zdr: true | roadmap OpenRouter documents this shape; our gateway does not enforce it yet — the honest status. |
| No training on your data | Exclude providers that retain or train on inputs. | provider.data_collection: "deny" | roadmap Needs a per-provider retention flag in the catalog. |
| Data residency | Keep processing in-region (e.g. EU-only). | eu.openrouter.ai / region-pinned endpoints | roadmap Provider-side capability; would become a routing constraint. |
| Provider pinning + fail-closed | Pin approved providers and ERROR rather than silently falling back to a non-compliant one. | only / order + allow_fallbacks: false | partial today Our gateway already scopes providers via X-Switchboard-Providers; fail-closed (no fallback outside the allowed set) follows from it. |
| AI disclosure stamping | Stamp responses as AI-generated to help satisfy Art 50(1). | response header / disclosure field | roadmap A natural gateway feature: one flag, applied to every routed response. |
First European standard published in support of the AI Act — a sector-neutral quality-management system aimed squarely at the Article 17 QMS duty.
Broader organisational AI-governance management system. EN 18286 Annex D maps across to ISO/IEC 42001 Annex A controls.
Under revision as part of the White House AI Action Plan; a concept note for a Critical Infrastructure profile landed 7 Apr 2026. COSAiS overlays and the Cyber AI Profile (IR 8596) remain drafts.
Final code assessed adequate by the Commission and AI Board. Section 1 = provider marking/detection (Art 50(2)); Section 2 = deployer deepfake/text labelling (Art 50(4)). ~190 organisations signed by 31 Jul 2026.
The US pattern inverted in 2026: Colorado retreated from a duty-of-care model (SB24-205) to ADMT disclosure under SB26-189 with obligations from 1 Jan 2027, while California's training-data (AB 2013) and frontier-transparency (SB 53) laws went live 1 Jan 2026. Executive Order 14365 then put state AI laws under federal challenge, so treat US state rules as configuration, not hard-coded assumptions.