#
CCW GGE on LAWS - rolling text (18 December 2025 version) (Draft, no legal force): Draft rolling text under negotiation in the UN CCW Group of Governmental Experts on lethal autonomous weapons systems.
11 instruments (11 current) · 10 obligations · 24 claims · 13 milestones
Instruments
- CCW GGE on LAWS - rolling text (18 December 2025 version) Draft, no legal force
Draft rolling text under negotiation in the UN CCW Group of Governmental Experts on lethal autonomous weapons systems.
- Data Act Valid from 2025-09-12
Data access and cloud-switching rules that affect AI data supply and cloud-hosted AI services.
- Digital Omnibus on AI Valid from 2026-07-27
Amends the AI Act timeline, adds Article 5 prohibitions on non-consensual intimate deepfakes and CSAM-type material, replaces Article 4 and adjusts sandbox and AI Office powers.
- Digital Services Act Valid from 2024-02-17
Platform regulation under which the Commission designates very large platforms and search engines (now including ChatGPT) and enforces systemic-risk duties covering algorithmic systems.
- ESAs statement on ICT risks from frontier AI models Valid from 2026-07-31
Joint EBA, EIOPA and ESMA statement calling for consistent risk-based supervision of ICT risks from frontier AI models.
- EU KIDS Act proposal Draft, no legal force
Commission proposal to protect children online that would require AI companions and chatbots off by default.
- Italian Law on artificial intelligence Valid from 2025-10-10
Italian national framework law designating AgID and ACN, regulating AI in work and professions, copyright and criminal law.
- Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability) In force since 2026-09-30
Regulates police use of AI systems, adds a Criminal Code offence and corporate liability, and sets civil-procedure rules on evidence and causation for AI damage.
- Machinery Regulation (EU) 2023/1230 Valid from 2027-01-20
Product-safety regulation that adds essential requirements for machinery with self-evolving behaviour and requires third-party assessment for self-evolving machine-learning safety components.
- MDCG 2025-6 FAQ on the interplay between MDR/IVDR and the AI Act Valid from 2025-06-01
Commission-hosted MDCG FAQ dated June 2025 on how the AI Act interacts with the medical device regulations.
- Platform Work Directive Date not recorded
Gives platform workers transparency about, and limits on, automated monitoring and decision-making systems.
Obligations
- Article 3(1) (new third and following paragraphs of Article 8 of Regulation 2023/1230)
The Commission must adopt delegated acts amending Annex III of the Machinery Regulation to add health and safety requirements for high-risk AI systems that are machinery safety components or machinery, and those acts must apply by 2 August 2028.
- Art. 11(2)
The employer or principal must inform the worker of the use of artificial intelligence in the cases and manner of Article 1-bis of Legislative Decree 152/1997.
- Article 6(1), Article 25(2) and Annex I Part A points 5-6
Manufacturers of safety components with fully or partially self-evolving machine-learning behaviour, and of machinery embedding such systems, must use a third-party conformity assessment procedure (EU type-examination, full quality assurance or unit verification).
- Annex III Part B point 1
Manufacturers must include in their risk assessment hazards that may arise over the lifecycle from the intended evolution of self-evolving behaviour or logic in machinery designed to operate with varying levels of autonomy.
- Article 34(1)
Providers of very large online platforms and search engines must diligently identify, analyse and assess systemic risks from the design or functioning of their service, including algorithmic systems.
- Article 23
Providers of data processing services must take the measures in Articles 25 to 30 to enable customers to switch between services.
- Article 9(1)
Digital labour platforms must inform platform workers, their representatives and on request authorities of the use of automated monitoring or decision-making systems.
- Article 7(1)(a)
Digital labour platforms may not use automated monitoring or decision-making systems to process personal data on the emotional or psychological state of a person performing platform work.
- Pillar on safety by design (press release summary)
AI companions and chatbots would have to be turned off by default for children and could not simulate interpersonal relationships that create emotional dependency.
- Article 18(1)
In damages actions, where damage results from breach of one or more AI Act obligations, the causal link and the damage are presumed unless the contrary is proved.
Milestones
- Data Act applies Met
- Italian Law 132/2025 enters into force Met
- Omnibus enters into force Met
- Italian Legislative Decree 160/2026 enters into force Met
- Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Upcoming
- Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 Upcoming
- Platform Work Directive transposition deadline Upcoming
- ChatGPT, as designated very large online search engine, must comply with additional Digital Services Act obligations (four months after designation) Upcoming
- Machinery Regulation applies and Directive 2006/42/EC is repealed Upcoming
- National AI regulatory sandbox operational in each Member State Moved
- Chapter III Sections 1-3 apply to Annex III high-risk systems Moved
- Chapter III Sections 1-3 apply to Annex I (product-embedded) high-risk systems Moved
- Delegated acts adding AI health and safety requirements to the Machinery Regulation apply Upcoming
Claims and evidence (24)
The ESAs (EBA, EIOPA, ESMA) published a joint statement on 31 July 2026 calling for consistent cross-sectoral supervision of ICT risk from frontier AI models in finance.
Evidence and sources
- EBA, EIOPA and ESMA call for enhanced governance and consistent supervision to mitigate ICT risks from frontier AI models
The European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) today published a statement calling for a cross-sectoral, risk-based and consistent supervisory approach to mitigate the ICT risks stemming from frontier AI models.
- EBA, EIOPA and ESMA call for enhanced governance and consistent supervision to mitigate ICT risks from frontier AI models
The Medical Device Coordination Group published FAQ MDCG 2025-6 (June 2025) on the interplay between the MDR/IVDR and the AI Act.
Evidence and sources
- MDCG endorsed documents and other guidance
MDCG 2025-6|FAQ on Interplay between the Medical Devices Regulation (MDR) & In vitro Diagnostic Medical Devices Regulation (IVDR) and the Artificial Intelligence Act (AIA)|June 2025
- MDCG endorsed documents and other guidance
Regulation (EU) 2026/1744 amends the Machinery Regulation, adding a duty on the Commission to adopt delegated acts by 2 August 2028 on health and safety requirements for high-risk AI systems that are safety components of or constitute machinery, and a presumption of conformity route through AI Act standards.
Evidence and sources
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text
The Commission shall adopt delegated acts in accordance with Article 47 of this Regulation to amend Annex III to this Regulation by adding health and safety requirements in respect of Artificial Intelligence (AI) systems that are classified as high-risk pursuant to Article 6(1) of Regulation (EU) 2024/1689
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text
Those delegated acts shall apply by 2 August 2028.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text
10. Until harmonised standards or common specifications are referenced or adopted pursuant to this Article as regards high-risk AI systems, high-risk AI systems within the scope of this Regulation which comply with the relevant harmonised standards referenced, or common specifications adopted pursuant to Articles 40 and, respectively, 41 of Regulation (EU) 2024/1689 shall be presumed to be in conformity with the essential health and safety requirements set out in Annex III to this Regulation as regards high-risk AI systems.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text
The EBA, EIOPA and ESMA published a joint statement on 31 July 2026 calling for consistent supervision of ICT risks from frontier AI models in EU financial services.
Evidence and sources
- EBA, EIOPA and ESMA call for enhanced governance and consistent supervision to mitigate ICT risks from frontier AI models
The European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) today published a statement calling for a cross-sectoral, risk-based and consistent supervisory approach to mitigate the ICT risks stemming from frontier AI models.
- EBA, EIOPA and ESMA call for enhanced governance and consistent supervision to mitigate ICT risks from frontier AI models
MDCG 2025-6 is a Commission-hosted FAQ, dated June 2025, on the interplay between the MDR/IVDR and the AI Act.
Evidence and sources
- MDCG endorsed documents and other guidance
MDCG 2025-6|FAQ on Interplay between the Medical Devices Regulation (MDR) & In vitro Diagnostic Medical Devices Regulation (IVDR) and the Artificial Intelligence Act (AIA)|June 2025
- MDCG endorsed documents and other guidance
The UN CCW Group of Governmental Experts on lethal autonomous weapons systems is mandated to meet for 10 days in 2026 (2-6 March and 31 August-4 September), working from a rolling text dated 18 December 2025.
Evidence and sources
- CCW Group of Governmental Experts on lethal autonomous weapons systems, 2026
Group of Governmental Experts of the High Contracting Parties related to emerging technologies in the area of lethal autonomous weapons systems (LAWS), for a duration of 10 days, from 2-6 March 2026 and from 31 August-4 September 2026
- CCW Group of Governmental Experts on lethal autonomous weapons systems, 2026
Regulation (EU) 2023/1230 on machinery sets categories of machinery, including safety components with fully or partially self-evolving machine-learning behaviour, that require third-party conformity assessment.
Evidence and sources
- Regulation (EU) 2023/1230 on machinery (Official Journal text)
Machinery and related products that fall within the categories listed in Annex I, Part A, shall be subject to the specific conformity assessment procedures referred to in Article 25(2), and machinery and related products that fall within the categories listed in Annex I, Part B shall be subject to the specific conformity assessment procedures referred to in Article 25(3).
- Regulation (EU) 2023/1230 on machinery (Official Journal text)
Safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions. Machinery that has embedded systems with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions that have not been placed independently on the market, in respect only of those systems.
- Regulation (EU) 2023/1230 on machinery (Official Journal text)
Derived: Probable The Machinery Regulation repeals Directive 2006/42/EC with effect from 20 January 2027.
Evidence and sources
- Commission Implementing Decision C(2025) 129 of 20.1.2025 on a standardisation request as regards machinery and related products
That Directive is repealed with effect from 20 January 2027 by Regulation (EU) 2023/1230 of the European Parliament and of the Council3.
- Commission Implementing Decision C(2025) 129 of 20.1.2025 on a standardisation request as regards machinery and related products
Annex I Part A of the Machinery Regulation lists safety components with fully or partially self-evolving machine-learning behaviour as categories subject to third-party conformity assessment.
Evidence and sources
- Regulation (EU) 2023/1230 on machinery (Official Journal text)
Machinery and related products that fall within the categories listed in Annex I, Part A, shall be subject to the specific conformity assessment procedures referred to in Article 25(2), and machinery and related products that fall within the categories listed in Annex I, Part B shall be subject to the specific conformity assessment procedures referred to in Article 25(3).
- Regulation (EU) 2023/1230 on machinery (Official Journal text)
Safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions. Machinery that has embedded systems with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions that have not been placed independently on the market, in respect only of those systems.
- Regulation (EU) 2023/1230 on machinery (Official Journal text)
Regulation (EU) 2022/2065 (Digital Services Act) applies from 17 February 2024; Commission and national enforcement against AI-related services runs through it.
Evidence and sources
- Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text
This Regulation shall apply from 17 February 2024.
- Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text
Providers of very large online platforms and search engines must assess systemic risks stemming from the design or functioning of their service, including algorithmic systems.
Evidence and sources
- Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text
Providers of very large online platforms and of very large online search engines shall diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of their service and its related systems, including algorithmic systems, or from the use made of their services.
- Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text
Derived: Probable The Commission may fine a provider of a very large online platform or search engine up to 6% of total worldwide annual turnover.
Evidence and sources
- Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text
In the decision referred to in Article 73, the Commission may impose on the provider of the very large online platform or of the very large online search engine concerned fines not exceeding 6 % of its total worldwide annual turnover in the preceding financial year
- Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text
The Commission designated ChatGPT as a very large online search engine under the Digital Services Act, with compliance with additional obligations due by around January 2027.
Evidence and sources
- Commission designates ChatGPT, Reddit, Roblox under Digital Services Act
The Commission has designated ChatGPT as a Very Large Online Search Engine (VLOSE), as well as Reddit and Roblox as Very Large Online Platforms (VLOPs), under the Digital Services Act (DSA).
- Commission designates ChatGPT, Reddit, Roblox under Digital Services Act
Following the notification of the designations, these services have four months, i.e. by January 2027, to comply with the additional DSA obligations for VLOPs and VLOSEs
- Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text
The obligations set out in this Section shall apply, or cease to apply, to the very large online platforms and very large online search engines concerned from four months after the notification to the provider concerned referred to in the first subparagraph.
- Commission designates ChatGPT, Reddit, Roblox under Digital Services Act
Regulation (EU) 2024/2847 (Cyber Resilience Act) sets cybersecurity requirements for products with digital elements, including AI-enabled products, with staged application dates.
Evidence and sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text
This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text
The Data Act applies from 12 September 2025.
Evidence and sources
- Regulation (EU) 2023/2854 (Data Act), Official Journal text
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 12 September 2025.
- Regulation (EU) 2023/2854 (Data Act), Official Journal text
Providers of data processing services, including cloud services used for AI, must enable customer switching under Articles 25 to 30 of the Data Act.
Evidence and sources
- Regulation (EU) 2023/2854 (Data Act), Official Journal text
Providers of data processing services shall take the measures provided for in Articles 25, 26, 27, 29 and 30 to enable customers to switch to a data processing service, covering the same service type, which is provided by a different provider of data processing services, or to on-premises ICT infrastructure, or, where relevant, to use several providers of data processing services at the same time.
- Regulation (EU) 2023/2854 (Data Act), Official Journal text
Member States must transpose the Platform Work Directive by 2 December 2026.
Evidence and sources
- Directive (EU) 2024/2831 (Platform Work Directive), Official Journal text
Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by 2 December 2026.
- Directive (EU) 2024/2831 (Platform Work Directive), Official Journal text
Digital labour platforms must inform platform workers, their representatives and, on request, authorities of the use of automated monitoring or decision-making systems.
Evidence and sources
- Directive (EU) 2024/2831 (Platform Work Directive), Official Journal text
Member States shall require digital labour platforms to inform persons performing platform work, platform workers' representatives and, upon request, national competent authorities, of the use of automated monitoring systems or automated decision-making systems.
- Directive (EU) 2024/2831 (Platform Work Directive), Official Journal text
Digital labour platforms may not use automated monitoring or decision-making systems to process personal data on a worker's emotional or psychological state.
Evidence and sources
- Directive (EU) 2024/2831 (Platform Work Directive), Official Journal text
Digital labour platforms shall not, by means of automated monitoring systems or automated decision-making systems: (a) process any personal data on the emotional or psychological state of a person performing platform work;
- Directive (EU) 2024/2831 (Platform Work Directive), Official Journal text
The Commission adopted the EU KIDS Act proposal (COM(2026) 681) on 17 September 2026.
Evidence and sources
- EU KIDS Act to restrict social media platforms' access to children in the EU (IP/26/1890)
Today, the European Commission has adopted the EU KIDS Act to enhance the online safety of children throughout the Union.
- EU KIDS Act to restrict social media platforms' access to children in the EU (IP/26/1890)
The proposal would require AI companions and chatbots to be off by default and bar simulation of interpersonal relationships creating emotional dependency.
Evidence and sources
- EU KIDS Act to restrict social media platforms' access to children in the EU (IP/26/1890)
In addition, AI companions and chatbots must be turned off by default and cannot simulate interpersonal relationships in ways that create emotional dependency.
- EU KIDS Act to restrict social media platforms' access to children in the EU (IP/26/1890)
The enforcement framework builds on the structures already in place under the Digital Services Act and the Artificial Intelligence Act, making use of established mechanisms and existing expertise.
- EU KIDS Act to restrict social media platforms' access to children in the EU (IP/26/1890)
Derived: Probable Italian Legislative Decree 9 September 2026, n. 160 was published in the Gazzetta Ufficiale and adapts national law to the AI Act for police use and liability.
Evidence and sources
- Decreto legislativo 9 settembre 2026, n. 160 (Gazzetta Ufficiale entry)
Adaptation of national legislation to Regulation (EU) 2024/1689, as regards the use of AI systems for police activity and civil and criminal liability.
- Decreto legislativo 9 settembre 2026, n. 160 (Gazzetta Ufficiale entry)
Date of entry into force of the measure: 30/09/2026
- Decreto legislativo 9 settembre 2026, n. 160 (Gazzetta Ufficiale entry)
Derived: Probable The Italian decree enters into force on 30 September 2026.
Evidence and sources
- Decreto legislativo 9 settembre 2026, n. 160 (Gazzetta Ufficiale entry)
Date of entry into force of the measure: 30/09/2026
- Decreto legislativo 9 settembre 2026, n. 160 (Gazzetta Ufficiale entry)
Derived: Probable Article 18 presumes the causal link where damage results from breach of one or more AI Act obligations, unless the contrary is proved.
Evidence and sources
- Decreto legislativo 9 settembre 2026, n. 160 (copy of the Gazzetta Ufficiale text hosted by FNOMCeO)
Where the damage results from the breach of one or more obligations under Regulation (EU) 2024/1689, the causal link is presumed, unless proved otherwise.
- Decreto legislativo 9 settembre 2026, n. 160 (copy of the Gazzetta Ufficiale text hosted by FNOMCeO)