AI disclosure becomes an access gate, customs automation meets licensing limits, and launch readiness turns regulatory control point

Article 50 Turns Transparency into an Access Gate

The European Commission’s final Article 50 AI Act guidelines this week made transparency operational: providers must tell users when they are interacting with AI and attach machine-readable labels to AI-generated or manipulated content, while deployers must disclose deepfakes and certain public-interest AI-generated text. In parallel, the White House OSTP told federal agencies to complete AI impact assessments before buying high-risk generative AI tools, and Canada opened consultation on how AI transparency rules should be structured.

The EU also changed the clock. Through the Digital/AI Omnibus, standalone high-risk Annex III obligations move from 2 August 2026 to 2 December 2027, Annex I obligations from 2 August 2027 to 2 August 2028, and transparency and watermarking for existing systems to 2 December 2026. The practical effect is that disclosure, labeling, and assessment are now part of market-entry routing, with the same model needing different workflows by jurisdiction and channel, and state-level pressure reinforced by support for California’s AI disclosure law.

For Government & Regulatory Affairs teams, this is the next step after controls and assurance: turning legal text into jurisdiction-specific control maps, evidence requests, and launch gates. The function is becoming the coordinator of product, procurement, legal, and assurance decisions.

CBP Draws the Line on AI-Driven Customs Classification

CBP’s Jan. 16, 2026 HQ Ruling H350722 now makes AI-generated 8- or 10-digit HTSUS classifications a licensing issue: if software is producing entry-level classifications, it is performing “customs business” and requires a licensed customs broker. CBP drew a hard line at 6-digit HS classification and said Form 5106 and other entry-lifecycle automation can also fall within customs business. Disclaimers do not cure impermissible influence over actual entry decisions.

That ruling lands directly on importers, brokers, and AI vendors that have built end-to-end entry workflows around automated classification, especially in tariff-sensitive and forced-labor-risk categories such as textiles, solar/polysilicon, electronics, and certain agriculture. Where last week’s focus was on mapping tariff and export-control exposure, the operational question now is who can classify, who can approve, and where the human broker must remain in control.

For Government & Regulatory Affairs teams, the work is becoming more technical and more operational. The priority is to set AI decision boundaries, tighten broker oversight, and build auditable supplier-traceability controls that legal, customs, supply chain, and product teams can actually run.

EU Product Passports and Carbon Rules Turn Launch Readiness into a Control Point

The EU Digital Product Passport Registry must be live by 19 July 2026, with large batteries the first mandatory use case from 18 February 2027, turning registry registration into a gate for placing covered products on the EU market. Under the ESPR framework, firms will need a unique product identifier, a physical data carrier such as QR, RFID, or NFC, and machine-readable, tiered-access data fields defined by the relevant delegated act. The EU has also backed a ban on destroying unsold textiles and is tightening packaging, import, and traceability rules, while the UK has tightened packaging requirements but delayed parts of its plastics regime.

The same pattern is visible in carbon policy: the EU ETS package slows the cap decline, restores free allocation at 15% from 2028, and ties 80% of free allowances from 2031 to published decarbonisation investment plans, with the final 20% released only when investments or emissions cuts are evidenced. CBAM is delayed for covered sectors to end-2037/2038, extending overlapping carbon and border-pricing obligations. For regulatory affairs teams, this is the next step beyond tracking deadlines: dates, delegated acts, and supplier-data gaps now need SKU-level controls, escalation paths, and audit-ready workflows across procurement, sustainability, product, and IT.

Oklahoma Turns AI Approval Into a Regulatory Control Layer

Oklahoma’s BEACON rollout makes AI a governed control point for regulatory and procurement work, not a generic productivity layer. The statewide platform is built around an OMES-operated enterprise AI environment and a companion playbook, with the first lighthouse pilots focused on Administrative Rules Modernization and a Procurement Guidance Assistant. That choice matters: the state is putting rule review, compliance interpretation, and purchasing guidance at the front of the queue.

The oversight model is equally tight. Under Oklahoma’s AI standard, executive-branch systems must be reviewed before deployment and then approved, conditionally approved, or denied under CIO-led oversight. The Oklahoma Central Purchasing Act gives the CIO sole authority over AI-related IT acquisitions, with sign-off required on every purchase and added audit steps possible for multi-year renewals. Agencies cannot send HIPAA, FERPA, FTI, PII, or CJIS data through public AI systems, and secure use of BEACON requires prior CIO approval plus third-party security review, including supplier ATO and product security assessment.

For Government & Regulatory Affairs teams, the practical shift is now from tracking AI-enabled policy tools to navigating the approval pathways that determine whether they can be used at all. The teams that can translate policy goals into auditable workflows will shape which tools actually get deployed.