AI Deadline | Thursday 28 May 2026
Things moving through AI regulatory pipelines that will matter in the next 3 to 6 months
đŽ Act now
The FTC settled with Cox Media Group and two smaller marketing firms for just under $1 million this week. The charge: CMG told clients its AI service could target ads using conversations captured through customersâ phones and smart home devices. It couldnât. The actual product was resold email lists from data brokers, sold at a markup, with an AI story bolted on top.
Thatâs a fraud case on the surface. The FTCâs explanation of what went wrong makes it an AI case for you.
CMGâs pitch relied on two claims: that the AI genuinely did what it said, and that consumers had opted in to voice data collection by accepting app terms of service. The FTC called both false. On the consent point, the agency was specific: clicking through mandatory terms of service doesnât constitute opt-in consent for AI-based data collection happening inside consumersâ homes.
That second point is the one to note. A lot of AI products are built on consent frameworks where users accepted broad terms and the operator concluded thatâs good enough. It may not be. When the FTC looks at AI capability claims, it asks whether consumers could reasonably understand what they were agreeing to. Terms buried in click-wrap donât answer that question.
The FTC doesnât need a dedicated AI statute to act on this. Section 5 of the FTC Act prohibits unfair or deceptive practices. Thatâs what CMG was hit with. It applies to any company making AI capability claims that canât be backed up, or relying on consent mechanisms that donât cover what you think they cover.
Spend an hour this week looking at your marketing copy, your product claims and your consent flows. If youâre claiming your AI does something specific, you need to be able to demonstrate it. If your privacy consent relies on users accepting general terms, get clear on what that actually covers and where the gap is.
đĄ Heads up
đȘđș EU | Article 50 transparency guidelines consultation closes in six days
The Commissionâs draft transparency guidelines under Article 50 of the AI Act close for consultation on June 3. The 40-page document is the first official interpretation of what disclosure obligations the AI Act actually requires when users interact with AI systems or encounter AI-generated content. The final version guides enforcement from August 2. If your product runs a chatbot, generates content or powers any interface where users might not know theyâre talking to AI, the guidelines apply to you. Read the draft and submit a response if the Commission has got something wrong for your use case. The consultation form is on the Commissionâs digital strategy site.
đȘđș EU | The Omnibus formal adoption is a race, not a done deal
The Council confirmed the provisional Digital Omnibus agreement on May 13. Parliament and Council still need to formally vote, then the text needs to be published in the Official Journal. That has to happen before August 2 for high-risk AI companies to benefit from the December 2027 extension. Both institutions appear to be moving quickly, and formal adoption in June or July looks plausible. But âplausible before August 2â isnât the same as âguaranteed before August 2.â Donât stand down your compliance work on the assumption that the delay is already effective. GPAI obligations under Articles 51-55 werenât moved by the Omnibus in any case. August 2 is your date, regardless.
In focus
đșđž | The executive order Trump killed, and what it means for founders trying to plan
On May 21, the White House pulled a landmark AI executive order hours before it was scheduled to be signed. Trump told reporters he âdidnât like certain aspects of it.â The order would have directed federal agencies to collaborate with AI companies on voluntary pre-release model testing and set up cybersecurity frameworks around AI infrastructure. It was killed after objections from key tech executives and Trumpâs AI adviser, David Sacks.
The immediate reaction was confusion, and some of that confusion was justified. The order wasnât a crackdown. It was a framework for voluntary government engagement with the AI industry. Thatâs the kind of structured federal relationship the industry has asked for. It got killed anyway.
What makes this consequential isnât the specific provisions that were rejected. Itâs the signal it sends about the White Houseâs ability to produce a coherent federal AI framework.
For the past several months, the administration has been building toward federal preemption of state AI laws. The pitch to industry was: accept a federal framework, avoid the patchwork. That argument only holds if a federal framework actually materialises. Without an executive order and without federal legislation, states are filling the gap faster. Connecticutâs employment notification law takes effect October 1. Coloradoâs replacement framework takes effect January 1. Texas TRAIGA is already in force. California continues doing its own thing. None of those states are waiting.
The internal dynamics at the White House matter here. This order went through a full review process. It was hours from being signed. Then it wasnât. That kind of last-minute collapse doesnât happen over a sentence. It reflects a genuine, unresolved disagreement about what federal AI policy should look like. One faction wants voluntary industry engagement and light federal oversight. Another, led by some of the biggest players in the industry, doesnât want any federal oversight structure that could become a template for something heavier later.
The result is a federal AI policy posture thatâs internally contradicted and hard to plan around. Last Tuesday the administration was reportedly considering mandatory pre-release government vetting of new models. By Thursday it was distancing itself from that idea. That kind of reversal within a single week is not typical policy turbulence.
For founders, the practical planning question is whether to build compliance programs around a potential federal framework or around state law. The answer, right now, is state law. Federal preemption is a real possibility over the next 12-18 months, but itâs not a planning assumption for your next compliance deadline. Connecticutâs October 1 date and Coloradoâs January 1 date are both real. Theyâre coming. A federal framework that would preempt them hasnât been signed and may not be.
Build the state compliance program. If federal preemption lands and simplifies the picture, thatâs a nice problem to have.
đą On the radar
đŹđ§ UK | ICO automated decision-making consultation closes tomorrow. May 29 at 23:59. If you use AI in decisions about individuals for UK users and havenât engaged with this, youâre out of time as of tomorrow. Final ICO guidance on what the Data (Use and Access) Act requires is expected this summer.
đșđž USA | TAKE IT DOWN Act enforcement began May 19. The FTC is enforcing new rules requiring covered platforms to remove non-consensual intimate images, including AI-generated deepfakes, within 48 hours of a valid request. Penalties up to $53,088 per violation. The FTC sent warning letters to 12 large platforms, but the law covers any platform hosting user-generated content.
đșđž USA | Bartz v. Anthropic awaiting final approval order. Fairness hearing was May 14. Judge MartĂnez-OlguĂn took the matter under submission. Distribution calculations expected by June 11. The ~$3,000-per-book benchmark applies once the order issues, with an appeals window remaining open.
đșđž USA | Colorado SB189 heading to Governor Polis. The replacement AI disclosure framework passed May 12. Polis is expected to sign. Effective January 1, 2027. Original Colorado AI Act repealed and replaced.
đȘđș EU | August 2 is now 66 days away. Commission enforcement powers over GPAI providers activate on that date, along with Article 50 transparency obligations. If youâre a GPAI provider who hasnât signed the Code of Practice, the AI Office has been explicit that Code adherence is the first thing it will examine.
The one thing to do this week
Read your AI marketing copy and your consent flows. The Cox Media settlement describes exactly the kind of claim that draws a Section 5 complaint. An hour of review now is cheaper than explaining yourself to the FTC later.
Deadline tracker
EU | Article 50 transparency guidelines consultation | 3 June 2026 | 6 days remaining; respond via EC digital strategy portal
EU | GPAI enforcement and Article 50 transparency obligations go live | 2 August 2026 | 66 days; confirmed unchanged by Omnibus deal
EU | High-risk AI classification guidelines consultation | 23 June 2026 | Published May 19; 148-page draft under Article 6; respond via EC portal
EU | Digital Omnibus Official Journal publication | Estimated June/July 2026 | Council endorsed May 13; formal Parliament and Council votes pending; must publish before 2 August for deadline relief to take effect
EU | AI-generated content watermarking and labeling (Article 50) | 2 December 2026 | Moved by Omnibus from August 2; transitional period for systems already on market
EU | Nudification app ban | 2 December 2026 | Omnibus prohibition; AI systems generating non-consensual intimate imagery must cease or comply
EU | Annex III high-risk AI systems (employment, credit, biometrics, education) | 2 December 2027 | Subject to Official Journal publication of Omnibus; August 2, 2026 remains legally binding until then
EU | High-risk AI embedded in regulated products (Annex I: medical devices, machinery) | 2 August 2028 | Moved by Omnibus; same publication caveat applies
USA | Connecticut AI Responsibility and Transparency Act: employment notification obligations | 1 October 2026 | Signed; hiring AI in scope; disclosure and opt-out rights required
USA | Connecticut AI Responsibility and Transparency Act: companion chatbot and frontier model obligations | 1 January 2027 | Same bill; age verification, manipulative design prohibitions, minor access controls
USA | Colorado SB189 (replacement AI disclosure framework) | 1 January 2027 | Passed May 12; awaiting Polis signature; original Colorado AI Act repealed
USA | Texas TRAIGA high-risk AI obligations | 1 January 2026 | In force
USA | Bartz v. Anthropic copyright settlement | Final approval imminent | Fairness hearing May 14; ~$3,000/book benchmark; distributions expected from June
UK | ICO automated decision-making consultation | 29 May 2026 | Closes tomorrow at 23:59; final guidance expected summer 2026
UK | ICO Code of Practice on ADM | Late 2026 (estimated) | Draft expected after May 29 consultation closes; will interpret Data (Use and Access) Act obligations
UK | FCA Mills Review report | Summer 2026 | Incoming; AI in financial services
NOT ADVICE