In partnership with
Dear {{ first_name | reader }},
In this week's edition of Wag The Dog, I'm focusing on three EU regulations that impact crisis communication, and the practitioners in Chicago, Sydney, and Dubai who assume none of them apply. (just kidding 😅)
On 7 May, the EU AI Act's Article 50 transparency deadline moved. Not by much. Enough to matter if you've been running a compliance timeline.
What follows is my attempt to map what the legislation actually requires, strip out the commentary that circulates on LinkedIn, and give you something actionable before December.
I've included the decision matrix. I've included the penalty tiers. And because I kept getting the same question from colleagues outside Europe, I've addressed extraterritorial reach directly.
My reading, not legal advice. Check the note at the bottom.
Philippe
Before we start… Ask Me Anything – 28 May
On Thursday 28 May at 5:00 PM GMT+2, I'm running the first Wag The Dog Ask Me Anything – one hour, no slides, no prepared remarks, 25 seats, no replay, Chatham House Rules from first question to last.
Bring the scenarios your organisation won't discuss out loud, the decisions with no good option, the gap between what the frameworks say and what the room demands at 11pm on a Sunday when the story is already moving, and I'll answer as honestly as I can. It's free.
WAG THE DOG NEWSLETTER | ISSUE WEEK 20, 2026
KEY TAKEAWAYS
The deadline moved. Your timeline didn't.The EU AI Act's Article 50 transparency obligations now apply from 2 December 2026, not 2 August. If your compliance plan was built around the original date, it's wrong. Four months. Rebuild it.
Outside Europe doesn't mean outside the rules.Article 2(1)(c) is unambiguous: if AI-generated content is used or intended for use in the EU, the Act applies – regardless of where you're based. A crisis team in New York distributing synthetic audio to EU staff is caught. A PR firm in Sydney distributing an AI-drafted press release to European media is caught. The threshold is the destination, not the address.
Human review is not a workaround. It's the design.Article 50.4 contains an explicit exemption for AI-generated text that passes through human editorial review before publication. If a professional reviews, edits, and takes responsibility for the output, no label is required. The exemption was built for exactly this use case. Document that it happened.
Two other clocks are already running.NIS2 has been binding in transposing Member States since October 2024. DORA entered application on 17 January 2025. The AI Act gives you until December. Know which of the three applies to your clients – and whether they've checked.
Your first 24 hours are a communication problem, not a technical one.NIS2's mandatory early warning triggers within 24 hours of awareness of a significant cyber incident. Not confirmation. Not legal sign-off. Awareness. If IT, legal, and communications don't have pre-aligned notification templates before an incident happens, those 24 hours will be consumed by an internal argument. That's the failure mode I see most often.