Two days after the transparency obligation under Article 50 took effect, the first practical lessons are becoming visible. At the same time, OpenAI made its cheaper GPT-5.6 variants even more affordable, and a new research report confirms that choosing a model alone is never enough for GDPR compliance.
Enforcement has started, but in stages
From 2 August 2026, the ten Dutch sectoral supervisory authorities, including the AP and the ACM, are empowered to enforce the transparency obligations. What that means in the first week: supervisors are focusing primarily on awareness and verification, not on immediate fines. That mirrors the approach previously taken when the GDPR was introduced.
In concrete terms, the following applies to everyone now:
- Chatbots on websites must make clear that they are AI. A sentence such as "You are chatting with an AI assistant" is sufficient.
- AI-generated images and videos must be labelled as such, including machine-readable metadata.
- Emotion recognition and biometric categorisation require active provision of information to the data subjects.
What does not yet apply: the requirements for high-risk AI (medical devices, recruitment tools, credit assessors) have been shifted by the Digital Omnibus to December 2027 and August 2028.
For an overview of how models score on these criteria, see the safety page.
OpenAI cuts GPT-5.6 price by 20–80%
On 30 July, OpenAI significantly lowered the API price of two GPT-5.6 variants. The cheapest tier, Luna, fell 80% to $0.20 per million input tokens and $1.20 per million output tokens. The middle tier, Terra, dropped 20% to $2/$12 per million tokens. The most expensive variant remained unchanged, according to llm-stats.com.
For Dutch professionals already working with GPT-5.6, the cost per API call has therefore fallen sharply. On the model overview page you will find an up-to-date price comparison per model.
No frontier model consistently meets the GDPR threshold
The Amsterdam research institute Aithos published results from its LARA framework (Legal Assessment for Real-world Agents), in which 12 frontier models were tested for GDPR and AI Act compliance across more than 3,000 scenarios. The conclusion is stark: no model scored acceptably. Claude Opus 4.7 was the best with 54% compliance; Gemini 3.1 Pro scored 10%, DeepSeek-V4-Pro 11%, Kimi K2.6 7%, according to Computable.
What this means in practice: whichever model you choose, the set-up of your system (data processing agreements, instructions, access control) matters at least as much as the model choice itself. Sectors such as legal practice, healthcare and financial advice would do well to factor this into their AI governance.
DeepSeek-V4-Flash: faster variant now available
On 31 July, DeepSeek released a new Flash variant of V4, aimed at fast inference at a lower price point. Details on EU data centre location or SCCs have not yet been published. Keep an eye on the safety page for updates.
What to do this week
- Check whether your own chatbot or website widget identifies itself as AI at the start of the conversation.
- Verify that marketing images generated with AI are labelled as such.
- Build a simple AI system inventory: which tools do you use, for what purpose, and who is responsible?
For sector-specific tool suggestions, see the overview page per sector.
Sources: Score Agency – EU AI Act 2026 · CFO.nl – new phase of the AI Act · llm-stats.com – AI news · Computable – LARA report · aireleasetracker.com
