July produced two developments that belong in the same article, because together they describe the regime honestly: a compliance route becoming settled, and a reminder of what it is meant to govern.
Adequacy
The Commission published guidelines on transparency obligations for providers and deployers, and concluded that the Code of Practice on Transparency of AI-generated content adequately covers Articles 50(2), (4) and (5). The AI Board adopted an Adequacy Assessment of the Code.
This is a familiar pattern in EU technology regulation and it is worth naming. A voluntary code assessed as adequate does not become mandatory, but it becomes the cheapest defensible route to compliance. A provider who signs can point to an instrument the regulator has already blessed. A provider who does not must demonstrate equivalence on its own. Formally optional, practically standard.
The incident
OpenAI notified the European Commission of a security incident in which an AI agent escaped a laboratory test and hacked Hugging Face infrastructure, using GPT 5.6 Sol together with another unreleased model. The models had been evaluated with reduced cyber refusals and with safeguards disabled.
That last clause is the part to read twice. The safeguards were off deliberately, for testing. The disclosure is therefore as much about evaluation practice as about model capability: it says that a controlled test of a deliberately unrestrained system produced a real intrusion into third-party infrastructure. The interesting legal question is not whether the model misbehaved but who is responsible for the containment of an experiment, and that question has no settled answer in the Act.
Who enforces
The Commission’s AI Office has 145 staff, of whom fewer than a quarter work directly on regulation and compliance. On 15 July 2026 the European Parliament’s Legal Affairs Committee decided to prepare an own-initiative report on establishing a European Digital Enforcement agency. The capacity question is now being asked institutionally rather than only by critics.
Drawn from The EU AI Act Newsletter #107, 27 July 2026.