AI Governance Regulation February 2026: What's Changed and What It Means

When this post was first published in February 2026, the biggest date in AI regulation was 2 August 2026, the day the EU AI Act's high-risk obligations were supposed to start biting. That date has moved. In July 2026 the EU's Digital Omnibus pushed the high-risk deadlines to December 2027 and August 2028, while the transparency duties went live on schedule, Colorado repealed its first-in-the-nation AI Act and replaced it with a narrower disclosure law, and Washington escalated its campaign to preempt state AI regulation. This is what the AI governance landscape actually looks like now, and what your business should do about it.

What changed since February 2026

Five developments reshaped the regulatory picture:

• The EU delayed its high-risk AI deadlines. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026. Obligations for high-risk systems listed in Annex III (employment screening, credit scoring, education, biometrics, access to essential services) now apply from 2 December 2027, not 2 August 2026. High-risk AI embedded in regulated products moves to 2 August 2028. Source: European Commission.
• EU transparency duties went live anyway. Article 50 of the AI Act was not deferred. Since 2 August 2026, providers and deployers must tell people when they are interacting with an AI system, label synthetic content and deepfakes, and disclose emotion-recognition or biometric-categorization systems. Source: Cooley.
• Colorado repealed and replaced its AI Act. SB 24-205, the first comprehensive US state AI law, was delayed to 30 June 2026, paused by a federal court in April 2026, then repealed on 14 May 2026 and replaced by SB 26-189, a disclosure-and-consumer-rights law that takes effect 1 January 2027. Source: AI Compliance Atlas.
• Texas TRAIGA took effect. The Texas Responsible AI Governance Act has been in force since 1 January 2026. It is prohibition-based rather than risk-tiered, enforced only by the Texas Attorney General, with an explicit safe harbor for organizations following the NIST AI Risk Management Framework. Source: Texas AI Report.
• Washington moved against state AI laws. Executive Order 14365 of 11 December 2025 created an AI Litigation Task Force to challenge state AI laws, directed the Commerce Department to identify "onerous" state laws, and tied some federal funding to states not enforcing them. A March 2026 National AI Policy Framework then asked Congress to preempt state AI laws that "impose undue burdens." Sources: White House, Morrison Foerster.

The EU AI Act: which deadlines moved and which did not

The single most important correction to make to any February 2026 compliance plan: the EU did not pause the AI Act. It deferred two deadlines and left everything else in place.

Already in force before August 2026:

• Prohibited practices (social scoring, manipulative techniques, most real-time biometric identification in public) and AI literacy obligations, since 2 February 2025.
• Obligations on general-purpose AI (GPAI) model providers, since 2 August 2025.
• From 2 August 2026, the European Commission gained the power to fine GPAI providers, and the EU AI Office's enforcement machinery became operational.

In force since 2 August 2026, unchanged by the omnibus:

• Article 50 transparency duties: chatbot disclosure, machine-readable marking and labelling of AI-generated content, deepfake labels, and notices for emotion-recognition and biometric-categorization systems. Providers of generative systems placed on the market before that date have until 2 December 2026 to retrofit the marking requirement.

Deferred by the Digital Omnibus:

• High-risk Annex III systems: 2 December 2027.
• High-risk AI embedded in products covered by EU safety legislation (machinery, toys, medical devices): 2 August 2028.
• Member-state regulatory sandboxes: 2 August 2027. We covered the original sandbox plan in our post on EU AI regulatory sandboxes; the obligation now lands a year later than that post assumed.
• High-risk systems intended for use by public authorities: 2 August 2030.

The reason for the delay matters. The Commission did not conclude that high-risk rules were wrong; it concluded that the harmonized technical standards needed to demonstrate conformity were not ready. The sixteen-month deferral is runway, not repeal. Companies that treat it as cancellation will face the same conformity assessments, technical documentation, human oversight and registration duties in late 2027 with less time to build them. The full timeline is set out clearly in Cooley's omnibus summary.

One scope point that catches non-EU companies: the AI Act applies to providers and deployers outside the EU when the system's output is used in the EU. A Kenyan or US company selling an AI-powered screening tool to European customers is in scope regardless of where the model runs.

The United States: a preemption fight, not new safety standards

The original version of this post referred to "new US federal AI safety standards announced in late 2025." That was wrong, and it is worth correcting directly. What the Trump administration announced in December 2025 was the opposite: Executive Order 14365 establishes a policy of "minimally burdensome" national AI regulation and deploys federal tools, including a dedicated litigation task force, funding conditions, and FCC and FTC proceedings, to challenge and preempt state AI laws. The order named the Colorado AI Act as an example of the kind of law it targets. The March 2026 National AI Policy Framework followed with legislative recommendations across seven pillars, explicitly including preemption of state AI laws, and explicitly ruling out a new federal AI regulator.

Two practical consequences:

• There is still no comprehensive US federal AI statute. Federal action so far consists of executive orders, agency proceedings, and proposed legislation. An executive order does not itself invalidate a state law; the challenges run through courts and agencies, and states have pushed back.
• State law is where the binding rules live, and the states are diverging. Texas prohibits defined harmful uses and requires disclosure mainly in government and healthcare contexts. Colorado, after its repeal-and-replace, will require disclosures and grant limited consumer rights from 1 January 2027, with no impact-assessment duty. California's privacy regulator has finalized rules on automated decision-making technology, and Illinois amended its Human Rights Act to cover AI in employment. We track this split in more detail in our analysis of the federal vs state AI regulation fight.

Outside the US and EU, the risk-based model is spreading: Vietnam enacted an EU-style risk-based AI law, and several other jurisdictions are borrowing the EU's tiered structure while asserting local sovereignty.

What to do now: a six-step compliance plan

The deferral creates an unusual window: the transparency rules are live, the heavy high-risk duties are dated but distant, and the standards are still being written. Use it in this order.

1. Inventory every AI system you build, buy or embed. Include third-party tools, features inside SaaS products, and models your teams call through APIs. You cannot classify what you have not listed.

2. Classify each system against the EU categories. Ask four questions of each: Is any use prohibited under Article 5? Does it trigger Article 50 transparency duties (chatbots, generative content, emotion recognition)? Is it a candidate Annex III high-risk use (employment, credit, education, essential services, biometrics)? Are you a provider or a deployer? The answers decide your deadlines.

3. Fix transparency gaps first, because they are enforceable today. If customers in the EU interact with a chatbot on your site and are not told it is an AI system, that gap is live now, not in 2027. The same applies to unlabelled AI-generated images, video, or audio you publish.

4. Build the high-risk file while you have runway. For any system that will be high-risk from December 2027, start the documentation now: risk-management process, data-governance records, technical documentation, logging, human-oversight design, and accuracy and robustness testing. Use the NIST AI Risk Management Framework or ISO/IEC 42001 as scaffolding; both map reasonably well onto what the AI Act will ask for, and the NIST framework doubles as a safe harbor under the Texas law.

5. Tighten vendor diligence. If you deploy models or AI features from third parties, their compliance posture is part of yours. GPAI providers have had their own EU obligations since August 2025, so ask for their documentation rather than building around assumptions. For banks, insurers and funds, this diligence is exactly the kind of governance documentation we build as part of our enterprise AI work for regulated institutions and our Claude for financial services implementations, where KYC and audit-trail expectations predate the AI Act by years.

6. Track the US states where you operate or sell. Texas's prohibitions apply now. Colorado's disclosure duties start 1 January 2027. The federal preemption campaign may eventually simplify this map, but it has not done so yet, and compliance teams should plan for the state-by-state picture to persist through at least 2027.

Why the EU delay is not a reason to stop

Three arguments come up for standing down compliance work. None survives contact with the facts.

"The high-risk rules were delayed, so we can wait." Article 50 transparency duties were not delayed, and enforcement bodies have been operational since August 2026. Waiting only makes sense if you have confirmed nothing you deploy triggers the live obligations.

"The US will preempt state laws, so state compliance is wasted effort." Preemption requires legislation or successful litigation. Both are contested, and several states are still passing new AI laws. Planning on preemption happening on your timeline is a bet, not a compliance strategy.

"Our customers do not ask about this." Enterprise procurement teams already do. AI governance questionnaires, model documentation requests, and audit rights are standard in regulated-industry contracts regardless of what any statute says, and that commercial pressure does not move with regulatory deadlines.

Common mistakes to avoid

• Treating the omnibus as a cancellation. It moved two dates. The prohibitions, GPAI rules, transparency duties and enforcement powers all stand.
• Ignoring transparency because high-risk got delayed. Chatbot disclosure and content labelling are the obligations most likely to apply to an ordinary business, and they are the ones already in force.
• Assuming federal preemption protects you from state law. Until a court or Congress acts, state laws bind. Colorado's repeal shows states can also change course on their own.
• Overlooking third-party and embedded AI. Deploying a vendor's high-risk system still creates deployer obligations. Vendor due diligence is not optional.
• Retrofitting compliance at deployment. Conformity assessment, logging and human-oversight design are far cheaper to build in than to bolt on.

Frequently asked questions

Does the EU AI Act apply to companies based outside the EU? Yes. The Act applies to providers and deployers whose AI systems are placed on the EU market or whose outputs are used in the EU, regardless of where the company is incorporated. Non-EU businesses selling AI-enabled products or services to European customers should assume they are in scope.

What actually started applying on 2 August 2026? The Article 50 transparency obligations (chatbot disclosure, synthetic-content marking, deepfake labelling, emotion-recognition notices), the EU AI Office's enforcement powers including fines for GPAI providers, and the governance machinery of the Act. The high-risk system obligations that date was famous for were deferred to December 2027 and August 2028.

Do we still need an AI impact assessment? Under the EU AI Act, the conformity and fundamental-rights assessment duties for Annex III high-risk systems now bind from 2 December 2027. Colorado's replacement law dropped impact assessments entirely. But sector rules, procurement requirements, and frameworks like NIST AI RMF still push in the same direction, so most organizations building high-risk-adjacent systems keep doing them.

Is there a private right of action under these laws? No. Texas TRAIGA, Colorado's SB 26-189 and the EU AI Act all rely on government enforcement: the Texas and Colorado Attorneys General, and national authorities plus the EU AI Office in Europe. None of the three creates a private right of action, according to Texas AI Report's comparison.

We only use foundation models from big providers. Are we off the hook? No. GPAI model obligations sit on the model providers and have applied since August 2025, but deployers carry their own duties: transparency to end users, prohibited-use compliance, and (from late 2027) deployer obligations for high-risk uses. Your provider's compliance does not cover yours.

Where to go from here

The pattern across every jurisdiction in this post is the same: regulators want to know what AI you run, what it does, and who is accountable for it. If your organization cannot answer those three questions from its own documentation, that is the gap to close first, and it is closable in weeks rather than years. We help banks, insurers and other regulated businesses build exactly that: AI inventories, governance documentation, and private deployments designed for audit. See how we work on our enterprise page or book a call.

---

Build AI That Works For Your Business

At AI Agents Plus, we help companies move from AI experiments to production systems that deliver real ROI. Whether you need:

• Custom AI Agents — Autonomous systems that handle complex workflows, from customer service to operations
• Rapid AI Prototyping — Go from idea to working demo in days using vibe coding and modern AI frameworks
• Voice AI Solutions — Natural conversational interfaces for your products and services

We've built AI systems for startups and enterprises across Africa and beyond.

Ready to explore what AI can do for your business? Let's talk →

Related reading

• Claude Goes Free and Ad-Free While ChatGPT Rolls Out Ads: What the AI Monetization Battle Means