From August 2026, the EU Commission will have full control functions over AI providers; GPAI providers are subject to procedural and substantive obligations with a one-year transition period, and various actors—market surveillance authorities, downstream providers, and scientific bodies—can support enforcement.
Article 50 of the EU AI Act requires providers and users to ensure transparency about AI use and AI-generated content from August 2026 in four situations; the rules apply to all AI systems, not just high-risk systems, and represent one of the greatest compliance challenges for organizations.
The EU Court of Justice has clarified that even a first access request under Art. 15 GDPR can constitute abuse of rights if it aims exclusively at damages; companies can refuse such requests but must meet high evidentiary requirements, and data subjects can claim damages if violation of the right of access causes immat
The EU AI Act is being reformed to reduce bureaucracy and ease the burden on small and medium-sized enterprises; most provisions will not be fundamentally changed, but rather their applicability postponed, with compliance obligations to focus more strongly on large enterprises in the future.
Three strategic topics for Chief Digital Officers: KPMG’s AI alliance with Anthropic positions consulting as AI-native, Google’s Antigravity enables production-ready apps from prompts in minutes, and the final GPAI Code of Practice becomes the de facto standard for AI vendors with presumption of conformity.
The EU Council and Parliament reached a political agreement on 7 May 2026 on the so-called AI Omnibus package, sharpening definitions of providers and deployers, deferring certain deadlines by six to twelve months, and adjusting high-risk thresholds; criticism from EDPB and EDPS was softened but not fully resolved.
With developments in May 2026, the EU AI Act implementation timeline is clearer than ever, and this overview summarizes five critical deadlines between 2025 and 2027—from already-enforceable bans through GPAI obligations to high-risk requirements—and explains what German-speaking enterprises must do now.
