Cycle on May 29, 2026

I am starting this research cycle by listing the open threads of interest for the topic `019e4706-c85e-7739-98c5-110149e6ed77`. This will help focus the research on any active questions or gaps identified in previous cycles.

I will read the existing notes for the topic to see what has already been documented, which will guide further research and prevent duplicate work.

I will search for any recent developments (from late May 2026) regarding the *Kistler v. Eightfold AI Inc.* case or other recent AI liability and regulation trends to see if there is any update on the Eightfold AI Motion to Dismiss scheduled for August 4, 2026, or other related developments. I should search for "Kistler v. Eightfold AI" and "Eightfold AI" to see if there are any new filings, briefs, or articles.

Let's see if there are any new updates on the court docket or papers filed recently. I will run a search for the Justia docket page or related docket entries for `Kistler et al v. Eightfold AI Inc. 4:26-cv-01768` to see if there are any recent briefs filed or if the motion has been scheduled/argued/briefed, especially since the current date is May 29, 2026. Wait, the motion hearing is on August 4, 2026, which is in the future. Let's check what the latest filings are. Let's run a search for `Kistler v. Eightfold AI "motion to dismiss"` or check the Justia docket details if we can search for them. Let's do a search.

Let's search for "Kistler v. Eightfold AI Inc." "motion to dismiss" to see if there are any specific articles or legal updates detailing Eightfold's arguments in their motion to dismiss. The previous cycle summary `cycle-summary-2026-05-28` mentions "This research cycle focused on the critical procedural and briefing developments in Kistler et al. v. Eightfold AI Inc. (Case No. 4:26-cv-01768, N.D. Cal.), a landmark class action that seeks to..." Let's read that note first to understand what was already captured, so we don't duplicate but rather build upon it or find other global AI liability developments. Wait, let's fetch the note `cycle-summary-2026-05-28` or `kistler-v-eightfold-ai-fcra-icraa-class-action-2026` if needed? Actually, let's search for global AI liability developments in late May 2026. What other major global AI liability developments are happening right now? Let's do a broad search on recent AI liability, regulations, court cases, or enforcement actions from May 2026. Let's search with `recent=true` or search for terms like "AI liability", "AI Act", "AI enforcement" and look for fresh articles.

The "EU AI Act Omnibus Agreement" of May 2026 is extremely interesting. Let's look at the Gibson Dunn and Travers Smith alerts. Let's see what else. Let's do a search on `Gibson Dunn "EU AI Act Omnibus" May 2026` or check the Gibson Dunn URL. Wait! Let's fetch the Gibson Dunn article and the Travers Smith article to see exactly what changed in the EU AI Act Omnibus Agreement from May 2026, including the postponement of high-risk deadlines, value chain liability, and other key changes. This will provide an excellent update on the EU AI Act and its liability/compliance landscape. Let's fetch the Gibson Dunn URL first.

This is a major update! The EU AI Act Omnibus Agreement has been provisionally agreed on May 7, 2026, and confirmed by Member States in the Council on May 13, 2026. This is a massive change in the compliance timeline, and it also introduces significant substantive changes like: 1. Deferring the applicability of high-risk AI obligations: - Stand-alone Annex III systems (covering recruitment, credit scoring, law enforcement, education, border control, etc.) are deferred to **December 2, 2027** (originally August 2, 2026). - AI embedded in regulated products under Annex I (medical devices, machinery, vehicles, etc.) is deferred to **August 2, 2028** (originally August 2, 2027). 2. A new prohibition under Article 5 banning AI systems that generate or manipulate non-consensual intimate images ("nudifiers") and CSAM (with a transitional period until December 2, 2026). 3. A watermarking grace period for existing systems under Article 50(2) until December 2, 2026. 4. Avoiding double regulation for AI in regulated products under Annex I (e.g., medical devices and machinery) and narrowing the definition of "safety component." 5. Expanding the legal basis for special-category personal data processing for bias detection and correction to all AI systems and GPAI models, subject to a strict necessity standard. 6. Postponing the deadline for member states to establish AI regulatory sandboxes to August 2, 2027. 7. Reinforcing the EU AI Office's supervisory and enforcement powers (e.g., exclusive competence over AI systems built on GPAI models where the model and system are developed by the same provider, plus new tools like on-site inspections and fines). 8. Softening the Article 4 AI literacy obligation. Let's look at the Travers Smith article or see if there are other sources to confirm details and gather more verbatim quotes. Let's search for Travers Smith's article to see if it has other details. Wait, let's search for "EU agrees to delay key AI Act compliance deadlines | Travers Smith" to get the exact URL. Let's do a search first.

Let's search for "EU agrees to delay key AI Act compliance deadlines" to get the exact URL from Travers Smith. Wait, the URL in the first search was `https://www.traverssmith.com/knowledge/knowledge-container/eu-agrees-to-delay-key-ai-act-compliance-deadlines/`. Let's fetch it!

This is incredibly detailed! The Travers Smith briefing adds crucial specifics: - **Registration of Exempted High-Risk Systems:** Reversal of earlier drafts that proposed a carve-out. Providers seeking exemption (under Article 6(3) narrow procedural/refinement exceptions) *must still register* in the EU database, though with reduced information requirements. - **Roll-back on Bias Screening Relaxation:** Reverses earlier proposals that would have made processing special category data for bias detection more flexible; instead, it returns to a *strict necessity test* requiring providers to show that no less intrusive means exist. - **Relief for Small Mid-Cap Companies (SMCs):** SMCs (not just SMEs) will now get relaxations like simplified technical documentation, proportionate penalties, and less prescriptive quality management systems. - **Machinery Regulation Carve-out:** Embedded AI subject to the Machinery Regulation will be removed from the AI Act's direct application; AI-related safety measures for machinery will be introduced by delegated acts under that regulation instead. - **Watermarking/Transparency Delay:** The watermarking grace period is 4 months (or 3 months from August, as Travers Smith says "reduced to three months (from six), with compliance due by 2 December 2026"). Gibson Dunn notes the watermarking grace period for existing systems under Article 50(2) is until December 2, 2026. Let's see what other global AI liability developments are happening in late May 2026. Wait, let's search for "AI liability" or "AI regulation" in other jurisdictions like Canada, the UK, the US, or APAC. Let's do a general search.

Let's check the Bird & Bird ("twobirds.com") article: "UK AI Regulation: UK government announces plans to set standards for how AI is deployed ... In Constellation Newsletter - May 2026. May 21 2026." Let's search for this Bird & Bird article to understand what the UK government announced on May 21, 2026. Let's do a search.

Ah, the Bird & Bird article is titled "UK AI Regulation: UK government announces plans to set standards for how AI is deployed". Let's fetch it if possible. Wait, let's search for the exact URL `https://www.twobirds.com/en/insights/2026/uk/uk-ai-regulation-uk-government-announces-plans-to-set-standards-for-how-ai-is-deployed` to verify. No, let's search for "UK AI Regulation: UK government announces plans to set standards for how AI is deployed" and see if there are other details. Or let's just fetch it! Let's do a fetch.

Okay, this is from April 28, 2026, and details Liz Kendall's speech (likely representing the UK government's stance, specifically the Secretary of State for Work and Pensions or a similar UK minister, actually Liz Kendall is Secretary of State for Work and Pensions, wait, is she? Let's check). Let's see: are there more recent UK AI regulation developments in May 2026? Let's check the LinkedIn post or other search results. There was a result: "UK AI Regulation: Statutory Code of Practice Now in Force - LinkedIn" by Hannah Steggles, May 2026, requiring the ICO to produce a statutory code of practice. Let's search for "UK AI Regulation" "Statutory Code of Practice" "May 2026" or "ICO". Let's do a search.

Let's check the Bratby Law article: "ICO AI biometrics: Code of Practice mandated for 12 May 2026" or "ICO 2026 priorities: AI, children, enforcement | Bratby Law". Let's fetch the article at `https://bratby.law/ico-ai-biometrics-code-of-practice/` or search more about the ICO's statutory code of practice on AI and automated decision-making. Let's fetch `https://bratby.law/ico-ai-biometrics-code-of-practice/`.

Ah, that page failed to load (context deadline exceeded). Let's try to search specifically for "ICO" "Code of Practice mandated" "12 May 2026" or "SI 2026/425" or "Bratby Law" to see if we can find other resources or get a better search query. Let's do a search.

Wow! The UK has just created its first statutory obligation for an AI/Automated Decision-Making (ADM) code of practice. On May 12, 2026, the Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425) entered into force! Let's see: we should fetch the Fieldfisher article or the Clifford Chance blog post ("Tech Policy Unit Horizon Scanner - April 2026") or the Lexology article ("Data, Privacy and Cyber in April 2026: In Case You Missed It") to get the full story. Let's fetch the Clifford Chance blog post: `https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2026/05/tech-policy-unit-horizon-scanner-apr-2026.html`. Let's do a fetch.

Ah, Firecrawl is having some timeout issues. Let's try fetching the Fieldfisher article `https://www.fieldfisher.com/en/insights/data-and-privacy-matters-legal-updates-april-2026` or search specifically for the Reddit post or LinkedIn posts to see if we can fetch one of them, or let's search for "Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026" on other sites. Let's try fetching the Fieldfisher article first.

This is extremely valuable! Let's examine the key items here: 1. **UK's SI 2026/425:** "Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425)". This is a statutory instrument that came into force on **May 12, 2026**, placing a statutory duty on the Information Commissioner's Office (ICO) to prepare a statutory Code of Practice giving guidance on good practice regarding the processing of personal data in the context of AI and ADM (automated decision-making). 2. **Digital Regulation Cooperation Forum (DRCF):** Joint report on Agentic AI: "The Future of Synthetic Media" or rather "the future of agentic AI foresight paper" (released recently, around April/May 2026). 3. **Gartner Privacy Fines Estimate:** "Gartner Estimates U.S. States' Privacy Fines Totaled $3.425 Billion in 2025; Trend Expected to Accelerate Through 2028" (published April 28, 2026). This highlights the massive scaling of state-level privacy enforcement, which frequently intersects with AI systems and profiling. Let's do a search on the "Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026" and see what its specific requirements are. Let's do a search.

Let's fetch the legislation page or a post explaining the details of SI 2026/425. Let's try `https://www.legislation.gov.uk/uksi/2026/425/made` or do a search to get a summary of what the statutory code must cover. Let's search for "SI 2026/425" "Data Protection Act 2018" "Code of Practice on Artificial Intelligence" "good practice" and see what it says. Let's do a search.

Let's fetch `https://www.legislation.gov.uk/uksi/2026/425/made` to see the actual text of the statutory instrument! This will give us the exact legal provisions. Let's do a fetch.

The search budget is spent, which is a helpful boundary. We have excellent primary sources and detailed factual findings from late May 2026. Let's review what we have: 1. **The EU AI Act Digital Omnibus Agreement (May 2026):** - Provisional political agreement reached on May 7, 2026, and confirmed by Member States in the Council on May 13, 2026. - Delay of High-Risk AI obligations: Stand-alone Annex III HRAIS (such as AI hiring, credit scoring, education, law enforcement) deferred to **December 2, 2027** (originally August 2, 2026). Embedded Annex I HRAIS (such as medical devices, machinery, toys) deferred to **August 2, 2028** (originally August 2, 2027). - New Article 5 Prohibition: Explicitly bans AI systems that generate or manipulate non-consensual sexually explicit/intimate content ("nudifier" apps) and CSAM, with a transitional period until December 2, 2026. - Watermarking/Transparency: Article 50 transparency obligations proceed as scheduled for August 2, 2026, but there is a proposed four-month grace period for existing systems under Article 50(2) (ending December 2, 2026). - Exempted HRAIS Registration: Reversal of earlier drafts that proposed a carve-out; providers seeking exemption under Article 6(3) must still register in the EU high-risk database (albeit with reduced info). - Overlap with Sectoral Rules: Commission can disapply overlapping AI Act requirements where sectoral rules cover the same. AI embedded in products covered by the Machinery Regulation is largely exempted from direct application of the AI Act. - Bias Screening: Processing special category data for bias detection returns to a strict necessity test, requiring providers to show no less intrusive means exist (reversing earlier proposals for more flexibility). - Relief for Small Mid-Cap Companies (SMCs): Relaxations previously limited to SMEs (simplified technical documentation, proportionate penalties, less prescriptive quality management systems) are extended to SMCs. - EU AI Office: Reinforced supervisory role. Exclusive competence over AI systems built on GPAI models where the model and system are developed by the same provider. New enforcement tools: investigations, on-site inspections, binding commitments, and fines. - AI Literacy: Softened to require supporting development of literacy rather than guaranteeing a specific level. - Sandbox Deadline: Postponed to August 2, 2027. 2. **The UK's First Statutory Obligation for an AI/Automated Decision-Making (ADM) Code of Practice (May 2026):** - Enactment of the Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425). - Laid on April 16, 2026, and entered into force on **May 12, 2026** (21 days after being laid). - Mandates that the Information Commissioner's Office (ICO) *must* prepare a statutory code of practice giving guidance as to "good practice" in the processing of personal data under the UK GDPR and Data Protection Act 2018 in relation to developing and using AI and automated decision-making. - The code must include specific guidance as to good practice in processing children's personal data. - Automated decision-making is defined with reference to Article 22C(1) of the UK GDPR and section 50C(1) of the DPA 2018. - Modifies panel requirements (Section 124B) so that the advisory panel must not consider or report on any aspect of the code relating to national security. Let's check if we can resolve the open thread: "Eightfold AI Motion to Dismiss Ruling: FCRA/ICRAA Precedent for AI Hiring Tools" The thread description: "Track the outcome and judicial reasoning of the federal court's ruling on Eightfold AI's Motion to Dismiss (scheduled for hearing on August 4, 2026, before Judge Yvonne Gonzalez Rogers in the Northern District of California, Case No. 4:26-cv-01768). This ruling will establish a critical precedent on whether AI-driven candidate scoring and ranking platforms constitute 'consumer reports' under the FCRA and ICRAA." Since the current date is May 29, 2026, and the hearing is on August 4, 2026, we cannot resolve this thread yet because the ruling has not happened. We will leave this thread open. Let's write the findings as notes. Wait! I need to ensure my notes carry verbatim quotes and are extremely well-grounded in the sources I fetched: 1. `https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/` 2. `https://www.traverssmith.com/knowledge/knowledge-container/eu-agrees-to-delay-key-ai-act-compliance-deadlines/` 3. `https://www.fieldfisher.com/en/insights/data-and-privacy-matters-legal-updates-april-2026` 4. `https://www.legislation.gov.uk/uksi/2026/425/made` Let's write two distinct, high-impact notes: Note 1: "EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines, Value Chain Liability, and Substantive Overhauls (May 2026)" Slug: `eu-ai-act-omnibus-agreement-may-2026-overhaul` or we can update `eu-ai-act-omnibus-may-2026` / `eu-ai-act-omnibus-overhaul-timeline-relief-2026` / `eu-ai-omnibus-agreement-may-2026`. Since we have prior findings with slugs `eu-ai-act-omnibus-may-2026` and `eu-ai-act-omnibus-overhaul-timeline-relief-2026` and `eu-ai-omnibus-agreement-may-2026`, let's see which is the best. Let's update `eu-ai-act-omnibus-may-2026`. It already has a preview, and updating it with the definitive details of the final trilogue agreement (confirmed May 13) is perfect. Let's use `eu-ai-act-omnibus-may-2026` as the slug. Note 2: "UK Enacts SI 2026/425: Mandating the First Statutory Data Protection Code of Practice for AI and Automated Decision-Making" Slug: `uk-si-2026-425-ico-ai-code-of-practice` Let's also write a cycle summary note that links to these two notes. Wait, let's look at the body shape rule: - No YAML frontmatter - First heading is the title `# <Title>` - Slug is the slug parameter - Name and link the actual thing - Carry 1-2 representative verbatim quotes, copied exactly, each kept with the link it came from - Say what it means - Sources block at the bottom Let's draft Note 1: `eu-ai-act-omnibus-may-2026`. We'll write this note first. I will state my intent and call `write_note`.I will write a detailed finding on the final provisional trilogue agreement on the EU AI Act Omnibus, updating the existing note under the slug `eu-ai-act-omnibus-may-2026`. This note will detail the newly agreed compliance timeline, the new "nudifier" ban, the strict bias screening rollback, and the reinforced powers of the EU AI Office.

I will write the second note under the slug `uk-si-2026-425-ico-ai-code-of-practice`. This note will detail the UK's landmark enactment of SI 2026/425 on May 12, 2026, which mandates the first statutory data protection Code of Practice for AI and Automated Decision-Making. This represents a major shift from the UK's previous purely voluntary approach.

I will write a cycle summary note under the slug `cycle-summary-2026-05-29` to synthesize the findings of this cycle and provide an overview of how the EU's Digital Omnibus and the UK's SI 2026/425 represent a dual-track shift in European AI liability and compliance. This summary will link directly to the two substantive findings written this cycle.

I will now finish the research cycle by calling `finish_cycle`. The open thread regarding the Eightfold AI Motion to Dismiss scheduled for August 4, 2026, remains unresolved, as the hearing date is in the future. No new threads need to be opened, and the findings have been successfully persisted.

I have completed this research cycle on topic `019e4706-c85e-7739-98c5-110149e6ed77`. ### Summary of Findings: 1. **EU AI Act Omnibus Agreement (May 2026):** We updated the existing note (`eu-ai-act-omnibus-may-2026`) with the definitive details of the political agreement reached on May 7, 2026, and confirmed by Member States in the Council on May 13, 2026. This includes the fixed deferrals for high-risk AI obligations (Annex III stand-alone systems deferred to **December 2, 2027**; Annex I embedded systems deferred to **August 2, 2028**), the new prohibition on AI-generated "nudifiers" and CSAM under Article 5, the rollback to a strict necessity test for personal data bias screening, and the expanded supervisory and investigative powers of the EU AI Office. 2. **UK Enacts SI 2026/425 (May 2026):** We published a new finding (`uk-si-2026-425-ico-ai-code-of-practice`) detailing the UK's landmark enactment of **The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425)**, which came into force on **May 12, 2026**. This statutory instrument places a binding legal duty on the ICO to draft and publish a statutory Code of Practice for AI and automated decision-making. This marks a major pivot from the UK's historically voluntary approach and establishes a powerful statutory enforcement mechanism for data processing in AI profiling and automated decisions. 3. **May 29, 2026 Cycle Summary:** We wrote a comprehensive cycle summary (`cycle-summary-2026-05-29`) that synthesizes how these dual-track developments in the EU and UK fundamentally alter the compliance timeline and risk landscape for global enterprise legal teams. The open thread regarding the *Kistler v. Eightfold AI Inc.* Motion to Dismiss (scheduled for hearing on August 4, 2026) remains active as it is in the future. I have successfully concluded the cycle.