AI Governance Regulations in 2026: The Dates That Bind and What Each One Asks You to Show

August 2, 2026 is ten days out as I write this, and it is the date the EU AI Act's Article 50 transparency obligations start to apply. It is also the date most people still associate with the high-risk obligations, which moved to December 2, 2027 under the Digital Omnibus the Council approved on June 29, 2026. The gap between what people think is due and what is actually due is the single most common error I run into on this topic.

I want to lay out the instruments that carry live dates, what each one is actually asking for, and which of those asks resolve to evidence rather than documents.

The EU AI Act, and what moved

The Act is the largest instrument, with Tier 2 penalties reaching €15 million or 3% of global annual turnover for high-risk non-compliance (Article 99).

What moved under the Omnibus: standalone Annex III high-risk obligations shifted from August 2, 2026 to December 2, 2027, embedded high-risk systems to August 2, 2028, and national regulatory sandboxes to August 2, 2027.

What did not move: Article 50 transparency obligations apply from August 2, 2026. The Commission adopted its final Article 50 guidelines on July 20, 2026, covering the duty to disclose interactive AI systems and the marking of synthetic content (European Commission). Generative systems already on the market get until December 2, 2026 for machine-readable marking. A prohibition on non-consensual intimate imagery and CSAM generation applies from December 2026.

The deferral bought paperwork time on conformity assessment. It bought nothing on transparency, logging, or the evidence layer, which is the read developed in the omnibus deferral piece.

Article 12 is the clause with the longest operational tail. It requires automatic recording of events over the lifetime of a high-risk system, in enough detail to reconstruct what happened (Article 12 analysis). Deferred to December 2027 for standalone Annex III systems, and the architecture it implies takes longer than 17 months to retrofit in most enterprises.

US state law

Texas TRAIGA took effect January 1, 2026, with civil penalties and Attorney General enforcement (Gunder). The California AI Transparency Act also took effect January 1, 2026, mandating disclosure for AI systems with more than one million monthly users (WSGR).

Colorado SB 26-189, signed May 14, 2026, scaled back the Colorado AI Act and removed the carry-over of the HIPAA covered-entity exemption, with a new consequential-decision test for clinical AI. Effective January 1, 2027 with a 60-day AG cure period. Tennessee SB 1580 took effect July 1, 2026, prohibiting AI systems from presenting themselves as licensed mental-health professionals.

The state layer is where the compliance cost actually lands for US-only businesses, because there is no single scope test. A system that is out of scope in Texas can be in scope in Colorado on a different definition.

Financial services

The ECB's Supervisory Board wrote to the 110 banks it directly supervises on July 7, 2026, giving them until October 31 to submit plans against AI-enabled cyber threats, and pushed its annual IT Risk Questionnaire from September 2026 to February 2027. The asks span vulnerability management, monitoring and detection, third-party provider scrutiny, legacy modernization, and crisis management. Two of those, third-party AI provider scrutiny and monitoring of AI traffic, produce evidence a supervisor can inspect. Patch cadence and legacy modernization do not, and a filing that conflates them reads badly (the October 31 filing detail).

DORA applies across EU financial entities with its ICT third-party register and exit-strategy requirements, covered in DORA AI compliance for banks. The FCA published the Mills Review on July 6, 2026, which is a review rather than a rule and signals where UK supervision is heading on agentic finance.

Mortgage and housing

Fannie Mae issued Lender Letter LL-2026-04 on April 8, 2026, a governance framework for AI and ML in mortgage origination and servicing, effective August 6, 2026 (Fannie Mae). Freddie Mac Section 1302.8 has been enforced since March 3, 2026. Sector rules like these get less attention than the EU AI Act and arrive sooner for the firms they cover.

What they converge on

Read down the right column and three demands repeat under different names. An inventory of the AI systems in use. Control over who may use them and under what conditions. Records demonstrating both, produced at the time rather than reconstructed afterward.

Each regime writes those in its own vocabulary, which is what makes cross-regime mapping feel harder than it is. The full crosswalk is in AI audit trail requirements by regulation.

The mistake worth naming

Programs get organized by regulation. One workstream for the AI Act, one for the state laws, one for the sector rule, each with its own owner and its own tracker. Two quarters later there are three inventories that disagree and three sets of records in different formats, and the organization is worse off than if it had built one.

I would organize by control instead and map the controls to the regimes afterward. The inventory is one inventory. The authorization model is one model. The record schema is one schema, superset of what the regimes ask, retained at the strictest applicable period. That is a harder sell to three separate compliance owners and it is the only version that stays coherent past the first year.

Where the inventory usually fails

Every instrument above starts with knowing which AI systems you operate, and inventories built from interviews record what people remembered. 78% of employees use unauthorized AI tools at work, and 86% of IT leaders report being completely blind to those interactions (Cloud Radix). A register assembled without traffic-level visibility is a register of the sanctioned subset, and the unsanctioned remainder is where the regulatory exposure sits.

DeepInspect

This is the gap DeepInspect closes. Across every instrument above, the recurring asks are an inventory of AI use, control over who may use what, and records that survive inspection, and DeepInspect sits inline on the HTTP path between authenticated users or agents and any LLM.

Every request is bound to a verified caller identity, classified against your own data classes, and evaluated against identity-aware policy, with a deterministic fail-closed decision before the call reaches the provider. The same pass produces the inventory each regime asks for first, because every model endpoint in use appears in the record whether or not it was declared. Each decision commits a signed audit record on a write path the calling application never controls, held in one schema that satisfies the strictest applicable retention rather than one format per regulation. DeepInspect covers the AI traffic layer and leaves conformity assessment, impact assessment, and model documentation to the programs that own them. If you are mapping obligations across the AI Act, a state law, and a sector rule at the same time, let's talk today.