Three weeks into September and the compliance alerts in your inbox contradict each other. One says the EU AI Act transparency rules are on the way. They arrived in August. Another says the EU digital identity wallet lands this month. It doesn't. This September 2026 compliance recap takes the six items that keep circulating and sorts them into what already binds you, what is still ahead, and what nobody has decided yet.
Already in force: AI Act transparency under Article 50
The transparency obligations in Article 50 of the AI Act have applied since 2 August 2026. If you were waiting for a start date, it's passed. The article covers telling people when they're dealing with an AI system, and marking content that an AI system generated or manipulated so that it can be detected as such.
The exposure sits in Article 99. For a breach it reaches a fixed maximum amount stated in the Regulation, or 3 percent of total worldwide annual turnover, whichever of the two is higher. Article 99(6) turns that around for SMEs and start-ups, which are capped at whichever of the two is lower. A turnover based ceiling means the number isn't the same for any two companies, and the smaller company version is a reduction, not an exemption.
Already in force: the copyright policy for general purpose AI models
Since 2 August 2025, Article 53(1)(c) of the AI Act has required providers of general purpose AI models to put in place a policy to identify and comply with a reservation of rights expressed under Article 4(3) of the DSM Directive. It binds a narrow group: the provider of the model. It doesn't reach the agency using a chatbot, or the publisher whose material a model was trained on.
For everyone else the significance runs the other way. The obligation only bites where a reservation exists and can be found, so if you hold rights and have never expressed one, there's nothing on the provider's side to identify.
Still ahead: two deadlines, and neither one falls in September
The first is 2 December 2026. It's a transitional deadline for the marking and detection obligation, and it applies to generative AI systems that were already on the market when Article 50 began to apply. Systems placed on the market after that point had no transition to use.
The second is 24 December 2026, and it belongs to the EU Digital Identity Wallet rather than the AI Act. Article 5a(1) of Regulation (EU) 2024/1183 gives each Member State 24 months from the entry into force of the implementing acts to make a wallet available. Those acts entered into force on 24 December 2024, which is where the date comes from. The separate obligation on private parties to accept the wallet arrives in December 2027.
Worth stating plainly, because the wallet produces more wrong dates than anything else here: there is no September wallet deadline. If a newsletter told you otherwise, the newsletter is wrong.
Not settled: one judgment under appeal, one trial that hasn't happened
In Kneschke v LAION, the Higher Regional Court of Hamburg gave judgment on 10 December 2025 in case 5 U 104/24. The court held that a reservation of rights was ineffective because it wasn't machine readable. General terms of use weren't enough. A machine readable format was required, such as robots.txt, the TDM Reservation Protocol, or metadata carried with the file.
That reasoning is already being quoted as if it were the last word. It isn't. A further appeal to the Bundesgerichtshof was expressly allowed, so the judgment is not final and the point can still change.
The other one is Andersen v Stability AI in the United States District Court for the Northern District of California, No. 3:23-cv-00201, before Judge William H. Orrick. A jury trial is set for 5 April 2027, with a pretrial conference on 1 March 2027. No verdict exists. Anything describing an outcome or an imminent decision there is describing something that hasn't happened.
The whole picture in one table
| Item | Status | Date | Who it binds |
|---|---|---|---|
| AI Act Article 50 transparency | In force | Applies since 2 August 2026 | Providers and deployers in the Article 50 scope |
| Marking and detection, transitional deadline | Still ahead | 2 December 2026 | Generative AI already on the market when Article 50 began to apply |
| Copyright policy, Article 53(1)(c) | In force | Since 2 August 2025 | Providers of general purpose AI models |
| EU Digital Identity Wallet, Article 5a(1) | Still ahead | 24 December 2026 | Member States |
| Private party acceptance of the wallet | Still ahead | December 2027 | Private parties in scope |
| Kneschke v LAION, case 5 U 104/24 | Judgment given, appeal to the Bundesgerichtshof allowed, not final | 10 December 2025 | Nothing binding follows yet |
| Andersen v Stability AI, No. 3:23-cv-00201 | No verdict, trial not yet held | Jury trial 5 April 2027 | Nobody yet |
More detail on the Article 50 obligations, and which systems fall inside them, sits on our EU AI Act page.
What is actually in your hands
Read down the table and a pattern shows up. Most of what's on it binds somebody else: a model provider, a Member State, or a court that hasn't ruled yet. Dates move, and appeals reopen questions people had already filed away as answered.
The part a business controls directly is narrower and steadier. You can show what you created, when you created it, and in what form, independently of whichever platform hosted the file or whichever provider trained on it. A qualified timestamp and seal, from Swiss Trust Layer or a comparable service, fixes that record while the work is in front of you, whichever way the December dates and the Hamburg appeal go.
