US federal · US states · enforcement actions · compliance deadlines

State AI laws · attorneys general · state agency rules · enforcement

Illinois signs SB 315, the first state law mandating independent AI safety audits

Illinois Governor's Office · 2 min

Governor Pritzker signed the AI Safety Measures Act on July 6: annual third-party audits, 72-hour critical-incident reporting (24 hours for imminent physical risk), whistleblower protections, effective January 1, 2027.

✅ Do this: Do this: If you train models above 10^26 FLOPs or clear $500M in revenue, you're a "large frontier developer" and the audit clock is running. Everyone else: expect the audit-and-verify template to migrate. Illinois AG has exclusive enforcement, $1M first violation, $3M after that, no private right of action.

Colorado's AI rulemaking comment window closed July 13, covering two laws at once

Colorado Attorney General · 2 min

Pre-rulemaking input on the Automated Decision-Making Technology Act (SB 26-189) and the new Chatbot Safety Act closed July 13; final rules must land by January 1, 2027.

✅ Do this: The rules will define "materially influence," which decides whether your scoring, ranking, or recommendation tools are in scope at all. If you missed the window, watch for the formal rulemaking phase: the AG has committed to further public input rounds before January.

EU AI Act · UK · APAC · OECD · multilateral · enforcement actions

EU AI Act · enforcement actions · compliance deadlines

Commission and AI Board declare the Transparency Code adequate, opening the compliance fast lane

European Commission · 2 min

The Commission's July 8 Opinion and the AI Board's July 9 adequacy assessment confirm the Code of Practice on Transparency of AI-generated content adequately covers Articles 50(2), (4), and (5).

✅ Do this: Signing is now the lowest-friction path to demonstrating Article 50 marking and labeling compliance from August 2. Submit the signatory form by July 22 to make the initial-signatories list. Adherence isn't conclusive proof of compliance, so keep your testing evidence anyway.

Commission unveils Cybersecurity and AI Action Plan, with pre-market model evaluation at its core

European Commission · 2 min

The July 7 plan builds EU capacity to evaluate advanced AI models before market placement, adds an ENISA blueprint for secure access to frontier models, and a secure testing platform for critical sectors.

✅ Do this: No new obligations yet, but read the direction: security evaluation is becoming a condition of supplying EU critical sectors (energy, transport, health, finance). Start documenting model security testing now; the EU evaluation capacity goes operational in 2027 and will feed the AI Office's regulatory function.

UK · APAC · OECD · Council of Europe · multilateral

UN convenes all 193 member states for its first Global Dialogue on AI Governance

UN News · 2 min

The inaugural session ran July 6–7 in Geneva under General Assembly mandate A/RES/79/325, with Guterres naming four priorities: common safety standards, human-rights red lines, capacity-building, and environmental transparency.

✅ Do this: No binding output, but the safety-standards workstream is where interoperability between the EU, US, and APAC regimes will get negotiated. If you operate across jurisdictions, one defensible governance baseline still beats chasing each regime; the UN track just reinforced that bet.

Funding · M&A · liability · insurance · the commercial signal

SK hynix raises $26.5B in the largest foreign US listing ever, and it's an AI memory bet

SK hynix · 2 min

The HBM leader's ADRs debuted on Nasdaq July 10, priced at $149 and closing up 13% at $168.01, in a listing that beat Alibaba's 2014 record.

✅ Do this: Your AI stack now runs through a supply chain where one company holds roughly 60% of high-bandwidth memory.

Add memory-supply concentration to vendor risk reviews, and if your own fundraising rides the AI wave, remember the discipline: every capability claim in the deck gets pressure-tested against what your systems actually do.

Model releases · capability shifts · technical changes that move your risk

Grok 4.5 ships with no safety card and no EU access, three weeks before GPAI enforcement

xAI · 2 min

The July 8 launch (1.5T parameters, $2/$6 per million tokens, trained with Cursor for hours-long agentic runs) included benchmarks but no system card, and skipped the EU until "mid-July."

✅ Do this: If Grok 4.5 enters your stack, demand the safety documentation the launch didn't include; your EU AI Act and vendor-diligence files need it regardless of what the provider publishes.

And read the EU holdback as the new normal: model availability now varies by jurisdiction, so build region-aware model routing into procurement.

GPT-5.6 goes public July 9, but only after a government-coordinated preview

OpenAI · 2 min

The Sol, Terra, and Luna tiers reached general availability 13 days after a limited preview run at the administration's request under the June 2 cyber executive order, following Commerce Department testing.

✅ Do this: Two frontier releases in one week both passed through government gates (US preview review, EU withholding).

Treat pre-release government review as an emerging de facto layer in your model supply chain: it affects release timing, and your own model-change management should stop assuming instant availability of new versions.

Signal over noise

Forward look: deadlines, comment windows, effective dates coming up

The final Digital Omnibus on AI: what actually changed in the text

Freshfields · 12 min read at source

The most useful long read this week walks the final Omnibus text amendment by amendment, now that Parliament (June 16) and Council (June 29) have both adopted it and only Official Journal publication remains.

The headline dates are confirmed: standalone Annex III high-risk obligations move to December 2, 2027, product-embedded Annex I systems to August 2, 2028, and the Article 50(2) machine-readable marking duty for systems already on the market lands December 2, 2026. The sharper findings sit below the dates.

The new Article 5 prohibition on AI-generated CSAM and non-consensual intimate content covers both placing such systems on the market and using them, and providers of general-purpose image and video tools must ship "reasonable and adequate" technical safeguards (refusal training, output controls, content filtering) by December 2, 2026, judged against the state of the art.

The AI Office's supervisory scope expands well beyond the original design, taking systems built on GPAI models where the same provider developed both. And the legal basis for processing special-category data for bias detection now extends to providers and deployers of all AI systems, but under a strict necessity standard, not the looser test the Commission first proposed.

The Machinery Regulation carve-out removes embedded AI in machinery products from the AI Act's high-risk regime entirely, a genuine scope reduction for industrial AI.

✅ Do this: Run your compliance program on two clocks. Clock one is near-term and unmoved: August 2 for Article 50 disclosure and GPAI enforcement, December 2 for marking and the new prohibitions, with safeguard evidence for any generative image or video product.

Clock two is the 2027/2028 high-risk runway: schedule the conformity work now and document the plan, because the obligations didn't shrink, only the deadline moved.