Deutsch
English
Español
Français
Nederlands
Português
Share
With the August 2, 2026 deadline now only weeks away, the EU AI Act enforcement phase is the single most consequential regulatory event in the AI industry this year. On that date, the European Commission's AI Office gains full enforcement powers over general-purpose AI (GPAI) providers, including authority to fine foundation model developers up to €15 million or 3% of global annual turnover for non-compliance. The change activates mandatory transparency obligations, systemic-risk duties for models trained above 10^25 FLOPs, and market surveillance across all 27 member states—with extraterritorial reach that pulls OpenAI, Google, Meta and Baidu into Europe's €16 trillion economy.
What Changes on August 2, 2026?
After two years of staggered implementation, the EU AI Act moves from drafting to direct enforcement. The Commission can now compel documentation, evaluate models before EU release, restrict market access, and order market withdrawal. According to Regulation AI analysis, two changes take effect simultaneously: Article 50 transparency obligations become directly applicable, and the Articles 88-101 enforcement machinery switches on. The May 7, 2026 Digital Omnibus agreement confirmed the timeline would proceed as scheduled.
- Chatbot disclosure and machine-readable marking of synthetic content (provider duties)
- Emotion-recognition notice and deepfake/public-interest text labelling (deployer duties)
- GPAI penalty powers up to €15 million or 3% of global turnover; prohibited practices up to €35 million or 7%
- Non-EU providers must appoint an EU-based authorized representative
Unlike the GDPR enforcement model, which relies heavily on national regulators, GPAI providers answer directly to Brussels, while everyone else faces national authorities.
GPAI Obligations Already in Force
Articles 53 and 55 have been in force since August 2, 2025, but August 2026 activates the enforcement machinery that gives them teeth. Article 53 requires every GPAI provider to maintain technical documentation, supply downstream information, adopt a copyright compliance policy, and publish a training-content summary. The July 10, 2025 GPAI Code of Practice offers a presumption-of-conformity framework, but the EU AI Act compliance checklist remains complex for many providers.
Systemic-Risk Threshold: 10^25 FLOPs
Models trained with more than 10^25 FLOPs are legally presumed to pose systemic risk. Providers must notify the Commission within two weeks, and the Commission can also designate lower-compute models based on capabilities, users, and reach. Article 55 adds four duties:
| Obligation | Requirement |
|---|---|
| Model evaluation | Standardized evaluations and documented adversarial testing |
| Risk assessment | Union-level systemic-risk assessment and mitigation |
| Incident reporting | Serious incidents within 15 days; 10 days for deaths, 2 days for critical infrastructure |
| Cybersecurity | Adequate protection for model and infrastructure |
These duties mirror emerging AI safety reporting regimes in other jurisdictions, but the EU is the first to attach binding fines.
Why Global Tech and Enterprises Are Watching
The Act applies to any company offering models in the EU, regardless of location. Open-source distribution does not remove liability—the entity placing a model on the EU market bears compliance responsibility. Even fine-tuning that uses more than one-third of the original training compute can reclassify a modifier as a GPAI provider. This mirrors pressures seen in the broader US-EU tech regulation dispute.
Readiness remains uneven. First-year compliance costs for large enterprises are estimated at €8 million to €15 million, yet 78% of organizations have taken no meaningful compliance steps, according to Informed Clearly reporting. Only 10 of 27 member states show advanced implementation progress, and key harmonised standards are not expected until Q4 2026.
Expert Perspectives
Lawyer Elisabetta Righini told CNBC that providers face liability not only for model non-compliance but also for refusing information requests, providing misleading answers, or blocking evaluations. OpenAI's Tom Duff Gordon said the company collaborates with the Commission on AI Act implementation, even as U.S.-EU tech tensions rise.
FAQ: EU AI Act Enforcement
What are the EU AI Act fines on August 2, 2026?
GPAI providers can be fined up to €15 million or 3% of global annual turnover, whichever is higher. Prohibited practices carry up to €35 million or 7%.
Which models count as systemic-risk GPAI?
Models trained above 10^25 FLOPs are presumed systemic-risk. The Commission can also designate lower-compute models under Article 52.
Do open-source models have to comply?
Yes. Open-source use does not remove liability; the entity placing the model on the EU market remains responsible, especially at systemic-risk scale.
What transparency duties start August 2, 2026?
Chatbot disclosure, machine-readable marking of synthetic content, emotion-recognition notice, and deepfake/public-interest text labelling.
What should enterprises do now?
Inventory GPAI deployments, obtain Article 53 documentation, classify use cases by risk tier, and establish incident reporting aligned with Article 55.
Conclusion and Future Outlook
A grace period for machine-readable marking of pre-existing generative systems closes December 2, 2026, while high-risk system rules are deferred to 2027 and 2028. For the first time, general-purpose AI has a binding enforcement regime. How global providers adapt over the next 12 weeks will likely shape the next decade of AI governance frameworks worldwide.
Follow Discussion