CyberEyeQ Weekly #29 — EU AI Act Enforcement Goes Live

This week: 11 regulatory developments across 6 jurisdictions. The EU AI Act's supervisor can now act, two imminent deadlines land within a fortnight, and the FTC opened a health-data enforcement case.

European Union · AI Governance · CRITICAL · Due 2026-08-02

The EU AI Act reached its general date of application on 2 August 2026, and the AI Office's supervision and fining powers over general-purpose AI (GPAI) model providers became exercisable the same day. The Commission opened complaints, whistleblower and downstream-provider channels. No formal enforcement action against a named provider has yet been published, but the powers are now live.

Action: Confirm whether any product you place on the EU market is a general-purpose AI model or triggers Article 50 transparency duties, and name an owner for AI Office correspondence. (source)

China · Data Security · CRITICAL · Due 2026-08-20

The Network Data Security Risk Assessment Measures (Order No. 24), jointly issued by the Cyberspace Administration of China and other departments, take effect on 20 August 2026. They require network data handlers meeting defined thresholds to conduct and document annual data-security risk assessments.

Action: Determine whether your China data processing crosses the Measures' thresholds and schedule the required annual data-security risk assessment before 20 August. (source)

Netherlands · Cybersecurity · CRITICAL · Due 2026-08-15

The Dutch Cyberbeveiligingswet, transposing the NIS2 Directive, is confirmed to enter into force on 15 August 2026, bringing an estimated 8,000+ entities into scope with registration, risk-management and incident-reporting obligations.

Action: If you operate essential or important services in the Netherlands, prepare to register with the supervisory authority and confirm incident-reporting and governance duties before 15 August. (source)

United States · Privacy · CRITICAL

The Federal Trade Commission, joined by Utah and California, sued Hims & Hers, alleging it shared consumers' sensitive health data with advertising platforms and used deceptive 'dark pattern' design in its subscription sign-up and cancellation flows.

Action: Audit any sharing of health or sensitive data with advertising platforms and review subscription and cancellation flows for dark-pattern risk. (source)

European Union · Cybersecurity · CRITICAL · Due 2026-09-11

Article 14 of the EU Cyber Resilience Act (Regulation (EU) 2024/2847) — the obligation to report actively exploited vulnerabilities and severe incidents — applies from 11 September 2026. The Commission has published implementation guidance; ENISA's single reporting platform is not yet live.

Action: Map which of your products with digital elements are in scope and stand up a 24-hour/72-hour reporting process before 11 September; note ENISA's single reporting platform may not be live at go-live. (source)

European Union · AI Governance

The EU AI Act reached its general date of application on 2 August 2026, and the AI Office's supervision and fining powers over general-purpose AI (GPAI) model providers became exercisable the same day. The Commission simultaneously opened its complaints tool, a whistleblower channel, and a downstream-provider channel, and published the first Transparency Code signatory list of roughly 190 organisations.

What changed is not the text of the obligations, most of which have existed on paper since 2024, but the fact that a supervisor can now act on them. Article 50 transparency duties for AI-generated content and the GPAI provider obligations are the near-term focus. As of the first days of enforcement no formal proceeding, decision or penalty against a named provider has been published, and practitioner commentary describes the AI Office's stated preference for opening with technical compliance dialogues rather than formal powers.

For compliance teams the practical gap is identification: many organisations still do not know whether a model they build on, fine-tune or distribute makes them a GPAI provider or a downstream provider with its own duties. The Commission's own AI Act Explorer has continued to serve the pre-Omnibus 2024 text, so teams relying on it for exact timing should instead read Regulation (EU) 2024/1689 together with the Digital Omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026.

Here is what organisations need to do first...

CyberEyeQ — Actionable Regulatory Intelligence · cybereyeq.com · [email protected]

This briefing is provided for informational purposes only and does not constitute legal advice.