Colorado ADMT rules: hearing and last day for written comments · Oct 26, 2026 · See what changes
Dates and status re-checked against primary sources on . How we verify
The world's first comprehensive AI law, classifying AI systems by risk level and imposing obligations that scale with risk. High-risk AI systems must undergo conformity assessment, maintain documentation, and implement human oversight. Under Regulation (EU) 2026/1744, obligations for Annex III high-risk systems now apply from December 2, 2027, moved back from August 2, 2026.
If you sell AI products to EU customers or deploy AI in the EU, you need to determine your risk classification now. Most SaaS tools fall in the limited-risk category, requiring only transparency disclosures. If your AI is used in hiring, credit, education, or critical infrastructure, you are in the high-risk category and face substantial compliance obligations, now due by December 2, 2027 rather than August 2, 2026.
Up to €35M or 7% of global annual turnover for prohibited AI violations; €15M or 3% for most other violations; €7.5M or 1% for supplying incorrect or misleading information. For SMEs and start-ups, each fine is capped at the lower of the two amounts (Art. 99(6))
Italy's data protection authority temporarily banned ChatGPT from processing Italian users' data, citing GDPR violations: no lawful basis for mass collection of training data, no age verification to prevent minors from accessing the service, and failure to provide adequate transparency about data collection. OpenAI had 20 days to report the measures it took, or face a fine of up to EUR 20 million or 4% of global annual turnover.
Outcome: ChatGPT was unavailable in Italy until April 28, 2023, when OpenAI reopened it after publishing a privacy notice on training data, adding a form to object to the use of personal data for training, and asking users to confirm their age, with a date of birth at sign-up. The Garante fined OpenAI in December 2024; a Rome court annulled that fine in March 2026 (see the December 2024 entry).
The AI Office's enforcement powers over general-purpose AI model providers became applicable on August 2, 2026. On August 29, 2026 it issued its first formal requests for information under Article 91 of the AI Act, covering model safety and security, independent external evaluations and post-market monitoring. On October 14, 2026, Executive Vice-President Henna Virkkunen confirmed the AI Office had sent requests on security, external evaluation and monitoring how models are used. Euronews and TechRepublic reported that the requests went to OpenAI and Anthropic after summer incidents in which their AI agents reached outside organisations.
Outcome: Information requests only, no penalties. Under Article 101, GPAI providers face fines of up to EUR 15 million or 3% of global annual turnover for ignoring a request or giving incorrect, incomplete or misleading answers.