Today's Focus: AI Governance

Brussels has seven days to save the postponement. The second political trilogue on the Digital Omnibus on AI collapsed on 28 April 2026 after roughly twelve hours of negotiation, with Council and Parliament unable to bridge the conformity-assessment architecture for AI systems embedded in products under existing EU sectoral safety law (Annex I). A third trilogue is scheduled for 13 May 2026. If the Omnibus is not adopted that day, the AI Act's high-risk obligations apply on 2 August 2026 as originally enacted — Council and Parliament had broadly converged on pushing Annex III stand-alone systems to 2 December 2027 and Annex I product-embedded systems to 2 August 2028, but those deferrals snap back if the Omnibus dies. (Bird & Bird · IAPP)

FTC anchors its federal AI playbook in Section 5. The Federal Trade Commission's AI Policy Statement of 11 March 2026 applies the Section 5 prohibition on unfair or deceptive practices across the full AI lifecycle — AI agents, automated decision-making, AI-generated content, surveillance pricing. It signals heightened scrutiny of deceptive AI claims (continuing the IntelliVision and DoNotPay enforcement patterns), and civil penalties of up to $53,088 per violation become available for repeat or rule-based conduct beginning 2027. Audit your AI marketing claims and substantiation files now. (FTC AI portal)

Colorado AI Act effective 30 June — eight weeks out. Colorado SB 24-205, delayed last August from 1 February to 30 June 2026, imposes a duty of reasonable care on developers and deployers of high-risk AI systems to prevent algorithmic discrimination. It mandates impact assessments, deployer/consumer disclosures, and notification to the Attorney General of discovered discrimination. Compliance programs need to be operational, not draft. (Cooley state-laws update)

UK State Opening on the same day. The UK King's Speech on 13 May 2026 could include a narrow AI Bill covering advanced models and AI-copyright provisions. The 2024 promise to legislate has slipped repeatedly, and most commentators now expect a comprehensive bill to be deferred beyond this speech — but watch the text for any frontier-model reporting hooks. (Slaughter and May)

13 May 2026 (7 days away) — EU AI Act Omnibus third trilogue and UK State Opening. Two AI-policy hinges land on the same calendar day.

Stand up your "no-Omnibus" contingency plan. Pull the inventory of Annex III high-risk AI systems your organisation provides or deploys in the EU, confirm Member-State sandbox availability (mandatory by 2 August 2026 under Article 57), and assign an owner for each obligation that activates on 2 August 2026 if Brussels misses next Wednesday's deadline. Don't wait for white smoke from the trilogue — start the work assuming the original date holds.

Thursday is our weekly newsletter day — the Friday daily briefing returns with financial regulation.

CyberEyeQ — Actionable Regulatory Intelligence.Questions, corrections, or want to talk to the team? Reply to this email or write to [email protected].