Welcome to the AI Brief from the YPO Technology Network. I'm Stephen Forte. Something entered into force in the European Union yesterday, and the headline you probably saw was that Europe has finally softened its AI rules. That headline is true. It is also the least useful half of the story because the rules they softened and the rules they left alone are not the same rules, and the ones they left alone take effect on Sunday. So here is what you will have by the end of this, which half of Europe's AI law just moved and which half did not, what the half that did not move actually asks you to do, which is smaller than you think, whether it applies to you if you have never set foot in Brussels, and the two things I would do before the weekend. Let me start with what happened. The European Union passed something called the digital omnibus on AI, and it came into force yesterday, the 27th of July. It is a simplification package, and it is a real one. The European Parliament approved it last month, 423 votes in favor, 57 against, and 174 abstentions, which is its own quiet commentary on how well anyone understood the original bill. And what it simplified was the heavy part. Under the AI Act, the European Union's main artificial intelligence law, the most demanding obligations fall on what it calls high-risk systems. Two families of those. The first is AI used in sensitive decisions, hiring, credit, education, essential services. That family has moved to December of 2027. The second is AI built into regulated physical products, medical devices, machinery, vehicles. That one has moved to August of 2028. Depending on which family you're in, that is up to 16 months of breathing room. Now, I want to be fair about this because I think this was the right call. Those obligations are genuinely heavy. They involve engineering work, documentation, conformity assessments, the kind of thing that takes a team in a year. If your company builds AI into a product that gets regulated, you just got real relief and you should take the win. Here is the part nobody has told you. The transparency rule did not move. In the same law, sitting well away from all the high-risk machinery, there is a provision that just asks for disclosure. It is Article 50. It does not care whether your AI is high risk It applies horizontally to almost everybody and it is short And when the drafters went through that file moving deadlines they went into Article 50 made their edits and left the date exactly where it was. The European Commission, which is the European Union's executive body, the one that proposes and enforces this kind of law, put it in a single sentence in its own published guidance. The transparency requirements, it says, will apply as of the 2nd of August, 2026, that is Sunday. And eight days ago on the 20th of July, the commission published its full interpretive guidelines on exactly how to comply with that rule. Nobody publishes a compliance manual a fortnight before a deadline they are planning to postpone. So let me tell you what it actually asks for, because this is the good news buried in a bad headline. There are four things and none of them require an engineer. The first, if a person is interacting with your AI, tell them. The exact wording is that people must be informed they are interacting with an AI system, unless that fact is already obvious to a reasonably observant person. That is a chatbot on your website, a voice agent answering your phone, an AI handling your support queue. The second, if your system generates synthetic content market, audio, image, video, or text produced by AI has to be marked in a machine-readable format, so software downstream can tell it was machine-made. Systems already on the market before Sunday get a few extra months on this one specifically. The third, if you deploy something that produces a deep fake, say so. The fourth, if you use emotion recognition or biometric categorization on people, tell the people. Now, here is a distinction that decides which of those four are yours. And almost nobody has read far enough to find it. The first, to land on providers, meaning the people who build and place the system on the market. The second two land on deployers, meaning the companies that use it. If you buy your AI rather than build it, you are usually a deployer, which means the obligations most likely to be yours are the two that most coverage of this law has ignored entirely. Let me talk about the money because there is one word in the penalty that does the real work. Breaching Article 50 puts you in the second of three penalty tiers. That tier is up to 15 million euros or 3 of total worldwide annual turnover whichever is higher Smaller companies get the lower of the two rather than the higher which is the one piece of genuine mercy in the provision Worldwide turnover, not your European revenue, not the revenue attributable to the chatbot, your entire global top line as the ceiling for a missing sentence on a support widget. Which brings me to the question that decides whether any of this is your problem. and I want to answer it for everyone listening because we are not all sitting in the same place. If you're listening in Munich, Milan, or Madrid, none of this is foreign law. It is your own regulator. Your counsel is almost certainly ahead of me and your question this week is narrower. Whether the delay you read about covered you and it probably did not. If you are listening in Sydney, Singapore, Dubai, Sao Paulo, Toronto, or Chicago, you may have filed this under European News and moved on. The scope provision says otherwise. The AI Act reaches three groups. Companies that place AI systems on the European market, companies established inside the union. And the one that catches everybody else, providers and deployers established anywhere in the world where the output produced by the AI system is used inside the union. Read that last one slowly. Not where your company is, not where your servers are, where the output lands. Picture a machinery manufacturer in Melbourne no European subsidiary, no European staff, no European anything except that 11% of its revenue comes from customers in Europe. And there is a support chatbot on its website that those customers use. That company is in scope on Sunday. And its exposure ceiling is calculated on its worldwide revenue, not on the 11%. Now, let me give you the honest other side, because you will hear a lot of noise about this over the next week, and most of it will be selling something. Enforcement of this rule is not central. It runs through market surveillance authorities in each of the 27 member states, and those are at very different stages of readiness. Some have been formally designated, several have not. There is no announced Europe-wide enforcement sweep for Sunday. The Commission's guidelines, helpful as they are, are interpretive rather than binding, and nobody has been fined under this provision for the simple reason that it does not exist yet. There is also that exemption sitting inside the first obligation. You do not have to announce the AI if the fact is already obvious to a reasonably observant person A support widget clearly labeled as an assistant may well already clear that bar So if somebody tries to sell you a six-figure compliance program this week on a deadline nobody is yet enforcing for a rule you may already satisfy, that is a sales cycle exploiting a calendar. This warrants an afternoon, not a project. Here is my read. This is the cheapest regulatory deadline you will be handed all year. And the risk is not that it is expensive. The risk is that it is so small it never gets assigned to anybody. And then 18 months from now, somebody asks a question in a diligence process and there is no answer. If I were sitting in your seat this week, I would do two things. First, build the wrong inventory on purpose. Not an inventory of your AI systems, an inventory of your European touch points. One question asked of your team, where can a person sitting in Europe encounter output from anything of ours that is AI generated? The website chat, the support autoresponder, the marketing images, the candidate screening tool, the product feature nobody remembers switching on. Most companies can finish that list in an afternoon and are quietly startled by its length. Second, add the disclosure before you buy the opinion about whether you needed it. The sentence is nearly free. The legal opinion is not. Do the cheap thing first and have counsel confirm afterward, which is precisely the reverse of how this will be handled almost everywhere. And give the commission some credit here because I mean it. They published plain language guidance with worked examples two weeks before the deadline on the obligation a normal company can actually satisfy while postponing the obligation that needs an engineering team. On this occasion, the bureaucracy got the sequencing exactly right. Europe did not blink. Europe moved the expensive part and kept the cheap part. The delay you read about was for the AI you probably do not build. The deadline that stayed is for the AI you already run. You have six days and the fix is one sentence that is the best ratio you will see all year. That is the YPO Tech Network AI brief for Tuesday, July 28th. I'm Stephen Forte. If this was useful, send it to a fellow member. I'll be back tomorrow with more. Until then, stay sharp.
