Ten AI ethics issues now have legal dates.

The ten issues we described in 2024 are still with us, but most now come with a legal date, a measurable control or published evidence. Here is what has changed and what to do about each.

In 2024 this article described AI ethics as a set of principles: security, privacy, explainability, bias mitigation and calibration. Those principles still hold. What has changed is that many of them now carry application dates. The EU AI Act, as amended by the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026), sets a clear timetable:

• Since 2 February 2025: prohibited practices apply, including social scoring and emotion recognition at work and in education (with medical and safety exceptions).
• Since 27 July 2026: a revised AI-literacy duty. Providers and deployers must take measures to support AI literacy; no specific level is required of any individual.
• Since 2 August 2026: Article 50 transparency duties, such as telling people they are interacting with an AI system.
• 2 December 2026: machine-readable marking of synthetic content for generative systems already on the market, and a new prohibition on AI systems that generate non-consensual intimate imagery or child sexual abuse material.
• 2 December 2027: high-risk duties for Annex III uses, including employment, credit, insurance, education and public services.
• 2 August 2028: high-risk duties for AI in regulated products (Annex I).

Source context: EU AI Act · consolidated 2026-07-27 ↗

Outside the EU the dates differ, but the direction is the same. Korea's AI Basic Act has applied since 22 January 2026, and Colorado and California rules on automated decisions apply from 1 January 2027. Labelling of AI-generated content is the one rule most regimes share.

Ethical controls now have to keep pace with a faster stack. Enterprises are multi-model by default: 81% of large companies use three or more model families (a16z, January 2026). Models also change quickly. OpenAI retires the GPT-4o and GPT-4.1 snapshots on 14 January 2027, and Anthropic retires Claude Sonnet 4.5 on 30 November 2026, about 14 months after its release. Every model swap is a moment when a bias test, an accuracy check or a documented decision can silently go out of date.

1. Copyright and training data. The legal picture is clearer, though not settled. General-purpose AI model obligations under the AI Act have applied since 2 August 2025, and the Commission can fine providers from 2 August 2026. The GPAI Code of Practice (July 2025), which includes a copyright chapter, has signatories including Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI. In the UK, the High Court ruled in Getty Images v Stability AI on 4 November 2025; Getty had dropped its primary infringement claims during trial and won only "extremely limited" trademark points. Practice: ask suppliers whether they signed the Code, and check rights and licence terms for each tool that generates content.

2. Biometric identification. Real-time remote biometric identification in public spaces for law enforcement is prohibited in the EU, with narrow exceptions, as is untargeted scraping of facial images. Practice: keep any biometric use in your AI inventory and confirm its legal basis before deployment.

3. Deepfakes and synthetic media. Machine-readable marking becomes mandatory in the EU for generative systems already on the market from 2 December 2026. China has required explicit and metadata labels since 1 September 2025, and India since 20 February 2026. Our companion article on synthetic faces and voices covers this in detail.

4. AI-enabled fraud and cyber attacks. Cyber incidents are the top business risk for the fifth year running (42% of responses), and AI jumped from tenth to second place (32%) in the Allianz Risk Barometer 2026. Shadow AI is involved in breaches at about one firm in five (IBM, via Help Net Security). Practice: make shadow AI visible through an inventory and give staff a sanctioned alternative.

5. Accountability when systems change. Fast model cycles mean responsibility must sit with a named owner, not with the original project team. Practice: record which model version each system uses and re-run your quality and fairness checks before every switch.

6. Work and workers. Measured effects are real but specific. In customer support, a generative AI assistant raised issues resolved per hour by 14% on average and 34% for less experienced agents (NBER). In a field experiment with about 70,000 applicants, AI-led interviews raised job starts by 18% (Erasmus). Recruitment and worker management are Annex III uses from 2 December 2027, and Italy's AI law already requires employers to inform staff when AI is used at work. Practice: involve employees and works councils from the start, and decide in advance where released capacity goes.

7. Accuracy in legal and justice contexts. Studies report hallucination rates of 17–33% in legal research tools (LLRX, February 2026). Administration of justice is an Annex III area. Practice: require source citations and human review for any output that affects rights.

8. Healthcare. 81% of US physicians now use AI, mostly for documentation (AMA, March 2026). AI in medical devices falls under Annex I, with AI Act duties from 2 August 2028. Practice: choose tools on documented validation and data-handling facts, and measure clinician time saved.

9. Automated decisions in public services and credit. US federal agencies reported 3,611 AI use cases in 2025, 445 of them high-impact, up from 1,757 in 2024 (OMB inventory). Creditworthiness assessment and access to public benefits are Annex III uses. Colorado's SB 26-189 requires notice, an explanation within 30 days of an adverse decision, and human review where commercially reasonable, from 1 January 2027. Practice: map every automated decision about people and prepare notices and an appeal route.

10. Surveillance and social scoring. Social scoring is banned in the EU, as is emotion recognition at work and in education, both since February 2025. Practice: check monitoring and analytics tools against these prohibitions, including features added in supplier updates.

Three practices make the ten issues manageable:

• One AI inventory. Record every system, its model version, its owner, its intended use and the earliest deadline that applies to it in each jurisdiction where you operate.
• Documented supplier facts. Obtain contractual facts for storage, inference, backups, sub-processors, training permissions, retention and exit. Distinguish opt-in from opt-out, and preserve each product and plan’s source conditions.
• Measured pilots. Agree a baseline, a success threshold and a stop condition before the pilot starts. Standards help here: 271 ISO/IEC 42001 AI management-system certificates had been issued worldwide by the end of 2025 (ISO Survey, via DQS).

Source context: ISO/IEC 42001:2023 ↗

An ethics list becomes useful when it changes a real choice. For each relevant issue, identify the affected people, the action under consideration, the evidence required and the person who can accept or reject the proposal. A broad commitment to fairness is important, but the operating question is what happens when a particular person receives an incorrect or harmful result.

Start with the intended use. A model used to draft a job description raises different questions from a system ranking candidates. A voice used in a fictional training character differs from an employee replica. The technical capability alone does not establish the ethical or legal position. Purpose, consequence, data and the conditions of use must remain connected.

Avoid a single pass or fail label for every use of a supplier. A product can support an acceptable low-consequence task while remaining unsuitable for another. Record the permitted boundary and the reason. This gives staff something they can follow and gives a future reviewer a basis for deciding whether a proposed change remains within scope.

Consider a hypothetical recruitment team using an assistant to summarise applications. The team first defines what information may be used, how the summary is checked and which decisions remain with qualified staff. It tests whether omissions or confident interpretations could disadvantage an applicant. A fluent summary should not silently become the authoritative record when the original application contains important context.

If a score influences the selection process, assess its actual effect rather than the name given to the feature. A human who routinely accepts a recommendation without the knowledge or authority to challenge it may not provide the safeguard the process assumes. The Dutch data-protection authority explains the importance of competent and authorised intervention in recruitment assessment. Regulator guidance.

Design a route for correction and challenge. The responsible person needs access to relevant source information and the ability to change the result. Keep the explanation specific to the actual process. A generic statement that humans remain responsible is weak if the interface or workload prevents them from exercising that responsibility.

Ethical issues often appear where two desirable objectives conflict. Faster handling may reduce review time. More personalisation may require more data. Wider access may increase exposure to an unreliable answer. Name the trade-off and identify boundaries that cannot be overridden by a better commercial result.

A practical workshop can use a small set of difficult cases. What happens when a source is missing, two records disagree or the requested action affects someone outside the original audience? Who can pause the workflow? What information does that person receive? The purpose is to discover where the design needs a stronger boundary, not to produce a reassuring discussion without a changed decision.

Preserve the disagreement where it matters. Stakeholders may reasonably judge consequences differently. A decision record should explain whose interests were considered and why a particular design was chosen. It should not erase a material objection merely because a majority preferred the project. That record helps a later review understand the conditions under which the choice was accepted.

A provider that does not publicly document a relevant condition has not automatically been proved unsafe. The buyer has an unanswered question. Conversely, a polished policy does not establish that an operating control works. Keep source statements, independent evidence and observations from your own deployment distinct.

Ask for the core facts that affect the use: applicable data region, training use, certifications and their scope, price, retention and deletion, and human review where relevant. Retain dates and qualifications. If primary sources materially disagree, show the conflict and seek clarification. Clear presentation should reduce unnecessary uncertainty without manufacturing certainty where the evidence does not support it.

This also applies to environmental and social claims. A provider's efficiency statement needs its unit, boundary and comparison. Lower resource use per operation can coexist with higher total use when demand grows. Do not infer a deployment's environmental result from a model marketing label. Establish which operational evidence would support the claim you intend to make.

A new purpose, population, data source or action can change the assessment. Link those triggers to an owner and a review process. If a draft-only assistant gains permission to act, its previous review is not sufficient evidence for the new consequence. If a system enters a different market, examine the relevant rules rather than copying the previous legal conclusion.

Keep an exit and recovery route. People affected by an error should not have to understand the model to reach a responsible person. Staff should be able to stop a problematic action without losing access to the underlying records needed to correct it. A usable correction path is part of the design, not an optional addition after a public complaint.

Use the Good AI Prism to inspect relevant offerings and carry their material questions into Compare. An AI Trust Record can organise one named system's evidence and responsibilities. An AI Trust Pilot can frame a bounded use-case test with agreed review and stopping conditions.

These are professional service requests, not certification or guaranteed approval. Bring the people affected, the action proposed and the evidence that could change the decision. The useful outcome is a justified boundary for useful work, with ownership and a way to correct it. Ethics becomes operational when that boundary remains meaningful after the presentation ends.

What to decide now

• Build or update your AI inventory and map each system to its earliest deadline: 2 December 2026, 1 January 2027 or 2 December 2027.
• Name an owner for each system who re-tests quality and fairness whenever the model version changes.
• Write the four supplier facts (hosting, training use, retention, exit) into every new contract and renewal.

The full evidence base, including the regulatory timetable for more than 30 economies, is in the Good AI Prism Global Market Study 2026/27 at ethority.ai/ai-prism-study.

• Regulation (EU) 2026/1744 (Digital Omnibus on AI): https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
• Lewis Silkin, The Digital Omnibus on AI enters into force today (27 Jul 2026): https://www.lewissilkin.com/en/insights/2026/07/27/the-digital-omnibus-on-ai-enters-into-force-today-102nedo
• nicfab, Digital Omnibus on AI in the Official Journal: https://www.nicfab.eu/en/posts/digital-omnibus-ai-official-journal/
• Regulation (EU) 2024/1689 (AI Act): https://eur-lex.europa.eu/eli/reg/2024/1689/oj
• European Commission, GPAI Code of Practice: https://digital-strategy.ec.europa.eu/policies/contents-code-gpai
• Cleary Gottlieb, Getty Images v Stability AI (Nov 2025): https://www.clearygottlieb.com/news-and-insights/publication-listing/uk-high-court-issues-landmark-ruling-in-getty-images-v-stability-ai
• a16z, enterprise AI survey (Jan 2026): https://a16z.com/leaders-gainers-and-unexpected-winners-in-the-enterprise-ai-arms-race/
• OpenAI, deprecations: https://developers.openai.com/api/docs/deprecations
• Anthropic, model deprecations: https://platform.claude.com/docs/en/about-claude/model-deprecations
• Allianz Risk Barometer 2026: https://commercial.allianz.com/news-and-insights/news/allianz-risk-barometer-2026.html
• Help Net Security, IBM Cost of a Data Breach 2025: https://helpnetsecurity.com/2025/08/04/ibm-cost-data-breach-report-2025
• NBER Working Paper 31161: https://www.nber.org/papers/w31161
• Erasmus University, AI job interviews field experiment: https://www.eur.nl/en/erim/events/ai-automation-job-interviews-natural-field-experiment-2025-10-28
• Norton Rose Fulbright, Italy Law No. 132/2025: https://www.nortonrosefulbright.com/en/knowledge/publications/9bfedfea/italy-enacts-law-no-132-2025-on-artificial-intelligence-sector-rules-and-next-steps
• LLRX, hallucinations in legal research (Feb 2026): https://www.llrx.com/2026/02/what-the-science-says-about-hallucinations-in-legal-research/
• AMA, AI use among physicians (Mar 2026): https://ama-assn.org/press-center/ama-press-releases/ama-ai-usage-among-doctors-doubles-confidence-technology-grows
• OMB, 2025 Federal Agency AI Use Case Inventory: https://github.com/ombegov/2025-Federal-Agency-AI-Use-Case-Inventory
• Colorado SB 26-189: https://leg.colorado.gov/bills/sb26-189
• ITA, South Korea AI Basic Act: https://www.trade.gov/market-intelligence/south-korea-ai-basic-act
• Loeb & Loeb, China AI labelling measures: https://www.loeb.com/en/insights/publications/2025/03/chinas-ai-labeling-measures-and-mandatory-national-standards-take-effect-september-1
• Hogan Lovells, India synthetic-content labelling (Feb 2026): https://www.hlc.com/en/publications/india-introduces-mandatory-labelling-for-ai-and-3hour-takedown-for-illegal-content
• DQS, ISO Survey 2025: https://www.dqsglobal.com/es/acerca-de/sala-de-prensa/iso-survey-2025-las-certificaciones-iso-crecen-un-11-en-el-mundo-y-un-28-en-espana
• ETHORITY, Good AI Prism Global Market Study 2026/27: https://ethority.ai/ai-prism-study

This article is not legal advice. Dates are application dates as published by October 2026.

Updated edition of the article first published on ethority.net in 2024; the original remains archived.