AI Compliance Map — Jul 24–31, 2026: EU timeline reset, Munich copyright ruling, and AI-pricing antitrust risk

Coverage and readout

This issue covers verified actions from July 24 at 5:00 p.m. through July 31 at 5:00 p.m. (UTC-05:00). The most consequential change is in the European Union: the AI Omnibus entered into force, moving several high-risk AI deadlines while the first transparency and enforcement obligations are about to become operational. At the same time, courts in Germany and the United States treated AI use as a source of ordinary copyright and antitrust exposure, not as a liability shield.

The practical split is clear. Product and model teams need a final EU Article 50 readiness check; AI music providers need to revisit training-data and memorization controls after the Munich ruling; pricing teams need to review whether shared algorithmic tools exchange competitors' non-public data. Ireland has put its national AI coordination body in place, while the UK and Singapore announcements are institutional signals rather than new private-sector duties.

No AI-specific regulator penalty or final administrative enforcement action was confirmed from a first-party detail page in this window. No new China AI rule was date-verified for the window. Complaints, proposals, and older effective dates are kept separate from enacted or operative action.

Executive action list

EU transparency: Complete the Article 50 inventory for interactive systems, synthetic-content marking, deepfake disclosures, and covered public-interest text before August 2. The Commission's guidance is now available, but it does not move the statutory application date. 1
EU timeline reset: Re-map roadmaps for Annex III high-risk systems and high-risk AI embedded in products. The Omnibus now points to December 2, 2027 and August 2, 2028, respectively. 2
Training-data controls: For generative music and other model providers, preserve provenance, licensing, memorization testing, and output-blocking evidence. The Munich Regional Court mostly upheld GEMA's claims against Suno and treated model memorization as a copyright-relevant reproduction. 3
Algorithmic pricing: Review whether a common pricing vendor receives or combines competitors' non-public data, and whether recommendations replace independent pricing decisions. The Third Circuit allowed a price-fixing case involving Cendyn's Rainmaker software to proceed. 4
Ireland and public-sector suppliers: Add Ireland's AI Office to the regulatory-contact map. It is expected to be operational on August 2 and will coordinate EU AI Act implementation and enforcement among designated authorities. 5

At a glance

Jurisdiction	In-window development	Status and affected parties	Compliance read-through
EU	AI Omnibus entered into force on July 27	Binding amendment; providers, deployers, smaller and mid-cap companies, and authorities	Rebaseline high-risk timelines and check new governance and sandbox provisions. 2
Ireland	AI Office established and first CEO appointed on July 30	Statutory implementation body; providers, deployers, importers, and national market-surveillance authorities	Expect a central contact point and coordinated supervision from August 2. 5
Germany / EU	Munich court mostly upheld GEMA's claims against Suno on July 31	Non-final civil judgment; AI music model provider and rights holders	Training-time copying, memorization, and outputs all need a documented rights theory. 3
United States	Third Circuit revived an algorithmic pricing antitrust case on July 29	Precedential appellate ruling; hotel and casino operators using shared pricing software	Treat shared data and vendor recommendations as antitrust controls, not just procurement choices. 4
California	Cal-Secure 2.0 announced July 31	State-government cybersecurity roadmap; California agencies and critical-sector partners	No new private-sector AI duty, but public-sector vendors should expect stronger AI-threat assurance questions. 6
UK	ICO published an AI-sandbox policy update on July 30	Feasibility and operating-model discussion; no new duty or deadline	Watch for future statutory changes; current sandbox participation does not replace ordinary data-protection compliance. 7
Singapore	MAS and ABS announced the ACT taskforce on July 28	Industry coordination signal on AI-driven cyber and technology resilience; detailed release body was unavailable in the retrieved page	Treat as a supervisory watch item, not a new legal obligation, until the scope and work products are published. 8

European Union: a timeline reset arrives beside an enforcement deadline

The AI Omnibus is now in force

The European Commission says the AI Omnibus entered into force on July 27. It extends the application of the Annex III high-risk rules to December 2, 2027, and the rules for high-risk AI embedded in physical products under Annex I to August 2, 2028. It also expands access to regulatory sandboxes, including an EU-level sandbox, extends some simplified treatment from SMEs to small mid-cap companies, simplifies certain database-registration duties, and gives the AI Office wider oversight of some general-purpose-model systems embedded in large online platforms and search engines. 2

That is a real schedule change, not a general grace period. Teams should split their implementation plan into obligations that moved and obligations that did not. A later Annex III date does not postpone Article 50 transparency work, the prohibitions, or the near-term start of supervision.

Article 50 is still the immediate operational task

The Commission's July 20 guidelines define the transparency obligations for providers and deployers and confirm that Article 50 applies from August 2, 2026. The guidance is aimed at covered interactive AI systems and synthetic audio, image, video, and text, including provider marking and detection duties and deployer disclosure duties for deepfakes and certain AI-generated public-interest text. 1

The companion Code of Practice is voluntary. Its initial-signatory form was due July 27 at 18:00 CEST, but not signing does not itself constitute non-compliance. The legal question for a non-signatory is whether it can show an alternative method that meets Article 50. 9

Compliance impact: The remaining work is evidence, not policy interpretation: map each covered output and interaction, identify the provider or deployer role, test marking and detection, capture the user-facing disclosure, and record exceptions and human-review paths.

AI literacy supervision begins with the Omnibus changes in view

The Commission's AI-literacy FAQ says Article 4 still requires providers and deployers to take measures supporting the AI literacy of staff and other people acting on their behalf. The Digital Omnibus removes the requirement to guarantee a specified level for each individual, while high-risk human-oversight training remains. The page states that supervision and enforcement of the AI-literacy rules begins on August 3, following national supervision from August 2. 10

Compliance impact: Replace generic training attestations with a role-and-use record: who handles which system, in what context, with what technical knowledge, and what human-oversight training is required for high-risk use.

Ireland: the national AI regulator architecture becomes tangible

Ireland's Department of Enterprise announced on July 30 that the Regulation of Artificial Intelligence Act 2026 had established the independent statutory AI Office of Ireland and that Paul Byrne had been appointed its first CEO. The Act was signed on July 21; the July 30 announcement is the in-window implementation action. 5

The Office will be Ireland's central coordinating body for EU AI Act implementation. The Act gives market-surveillance authorities a staged enforcement toolkit, from compliance notices to prohibition and seizure, followed by fines and prosecution, with adjudication and court oversight. The Office is expected to be operational on August 2 and will act as a single point of contact for the Commission, sector regulators, and the public. 5

The Irish Act is described by the government as a technical implementation measure that does not add obligations beyond the EU AI Regulation for regulated entities. 5

Compliance impact: Companies selling or deploying AI in Ireland should update their regulator map and complaint-escalation route, but should not treat the announcement as a new product requirement beyond the EU AI Act itself.

United States: state cybersecurity planning and two litigation signals

California's Cal-Secure 2.0 is a government roadmap, not a new private AI law

Governor Gavin Newsom announced Cal-Secure 2.0 on July 31. The roadmap directs California state agencies toward a stronger cybersecurity workforce, better cross-government coordination, and modernization for threats including AI-enabled cyberattacks. The announcement says agencies have flexibility to focus on their operational risks while working under a common statewide framework. 6

Compliance impact: This is not a new general duty for private AI companies. Vendors serving California government or critical sectors should nevertheless expect security questionnaires and procurement discussions to ask how their systems handle AI-enabled attacks, incident coordination, and emerging-technology risk.

Third Circuit: AI pricing software can be part of the antitrust theory

In Cornish-Adebiyi v. Caesars Entertainment, No. 24-3006, the Third Circuit issued a precedential opinion on July 29 reversing dismissal and remanding the case. The plaintiffs alleged that Atlantic City casino-hotel operators sent non-public pricing and occupancy data to Cendyn's Rainmaker software, which used AI-assisted algorithms to recommend room rates using the hotels' own and competitors' data. The opinion held that the allegations plausibly described a horizontal price-fixing conspiracy and a hub-and-spoke arrangement. 4

This is a procedural ruling, not a final finding that the defendants violated antitrust law. It is still a serious compliance signal because the court treated the shared algorithm, exchange of non-public data, and high adherence to recommendations as facts that can support an inference of coordination. 4

Compliance impact: Competition counsel should review pricing and recommendation tools for data pooling, common optimization targets, default acceptance rates, audit trails, and the ability of each customer to make independent decisions.

Federal watch: two comment deadlines are close, but neither is a final rule

The FTC's proposed policy statement on AI accuracy was published July 7 and seeks comments through July 31. It addresses Section 5 deception risks when companies market AI systems whose outputs are steered toward objectives different from what users requested or reasonably expected. The proposal is not a final rule. 11 12

The GSA's proposed GSAR 552.239-7001 clause for safeguarding government data in LLM systems has an August 3 comment deadline. The draft would cover LLM developers, operators, integrators, and service providers when government data is processed by an LLM, with proposed flow-down, data-use, localization, disclosure, deletion, and 72-hour reporting provisions. 13

Compliance impact: Federal contractors should treat these as comment-and-contracting signals, not current obligations; they should still compare the draft controls with existing government-data, incident-reporting, and subcontractor-governance processes before the deadlines pass.

Germany: Munich court rejects a broad AI-training defense in the Suno case

The Munich Regional Court I's July 31 press release in GEMA v. SUNO, case 42 O 763/25, says the court mostly upheld GEMA's claims for injunction, information, and damages. The decision concerns six musical works. The court found copyright-relevant reproduction during model training, in the model itself in Germany, and in outputs generated in Germany. It also rejected reliance on Germany's text-and-data-mining exception for the reproduction in the model. 3

The court's release says the model provider, rather than users, was responsible for infringing outputs generated by simple, open-ended prompts. It also says the judgment is not yet final. 3

Compliance impact: Generative-model providers should separate three records that are often collapsed into one: the legal basis for ingesting training data, tests for memorized protected works, and controls that prevent a model from reproducing those works in ordinary use. The ruling is not a universal answer to every training-data question, but it makes the cost of leaving those records implicit much higher.

United Kingdom and Singapore: institutional signals, not new private duties

The UK's Information Commissioner's Office wrote on July 30 that it is studying a statutory regulatory sandbox for data protection, which could give innovators time-limited flexibility from parts of data-protection law. The ICO says such a scheme would require legislative change and that the government must decide next steps; the announcement creates no binding duty or deadline. 7

Compliance impact: Keep the ordinary UK GDPR accountability baseline in place. A future sandbox could change how selected experiments are supervised, but it is not permission to deploy an unassessed AI system now.

Singapore's Monetary Authority and Association of Banks in Singapore announced the AI-Driven Cyber and Technology Risk Taskforce (ACT) on July 28. The official page describes it as an industry initiative to strengthen collective cyber and technology resilience against risks posed by frontier AI models. The page body was unavailable in the retrieved copy, so this issue records no membership, workstream, obligation, or deadline beyond that narrow announcement. 8

Compliance impact: Singapore financial institutions and their technology suppliers should watch for the taskforce's eventual recommendations; they should not describe the announcement as a new binding control.

China and enforcement watch

Targeted searches of official Chinese government and cyberspace-administration pages did not produce a date-verified AI rule, executive directive, court merits ruling, or AI enforcement penalty issued between July 24 and July 31. China's anthropomorphic-interactive-AI measures and July 15 filing announcements remain relevant to operations, but their dates fall outside this issue's strict window and they are not counted as new developments.

The same date-and-source check found no AI-specific regulator penalty or final administrative enforcement action in the United States, EU, UK, China, Canada, or Singapore during the window. That absence is a coverage result, not a claim that no AI-related complaint, investigation, or private dispute existed.

Deadlines through August 30

Date	Jurisdiction / item	Affected scope	Action
July 31, 2026	FTC proposed AI-accuracy policy statement	Companies marketing AI systems under potential Section 5 deception theories	Submit comments before the deadline if the proposal affects product claims, objective disclosure, or model-output representations. This is a proposal, not a final rule. 12
August 2, 2026	EU AI Act Article 50 transparency rules	Covered providers and deployers of interactive AI and AI-generated or manipulated content	Confirm marking, detection, deepfake disclosure, and covered public-interest text labelling. 1
August 2, 2026	Ireland AI Office expected to become operational	Companies interacting with Irish designated authorities, and EU AI Act providers/deployers operating in Ireland	Update regulatory contacts, complaint escalation, and evidence-routing procedures. 5
August 3, 2026	EU AI-literacy supervision and enforcement begins	Providers and deployers; high-risk human-oversight roles remain subject to training expectations	Retain role-based literacy and human-oversight evidence. 10
August 3, 2026	GSA draft GSAR 552.239-7001 comment deadline	Federal contractors and LLM developers, operators, integrators, and service providers processing government data	Review and comment on flow-down, safeguarding, localization, deletion, disclosure, and 72-hour reporting provisions. 13

Later dates worth keeping on the register

December 2, 2027: The Omnibus date for Annex III high-risk AI rules. 2
August 2, 2028: The Omnibus date for high-risk AI embedded in physical products under Annex I. 2

Coverage note

This map prioritizes official government, regulator, legislature, and court material. The Munich court ruling and the Third Circuit opinion are included as court developments; the FTC and GSA items are included as deadline watch items because their underlying notices pre-date the strict weekly window. The Singapore item is deliberately limited because the official release body was unavailable. No item was promoted as a current-week enactment, penalty, or merits ruling without a date-verified detail page.