The European Union’s AI Act is no longer mainly a statement of regulatory intent. Since August 2, 2026, the European Commission’s AI Office and national authorities have begun enforcing major parts of the law, while transparency duties for chatbots and synthetic content have started to apply (European Commission). Companies now have to translate a risk-based statute into product inventories, documentation, user notices, contracts, incident processes, and evidence that controls actually work.

The Act’s stated purpose is to promote “human centric and trustworthy artificial intelligence” while protecting health, safety, fundamental rights, democracy, and the rule of law. The difficult phase is implementation: deciding which actor is responsible, which rules apply to a system, and what sufficient compliance looks like when models and uses keep changing.

A layered calendar, not one start date

The Act entered into force on August 1, 2024, but its obligations arrived in stages. Prohibited practices and AI-literacy duties applied from February 2, 2025. Governance provisions and duties for general-purpose AI models followed on August 2, 2025. Enforcement powers and Article 50 transparency rules became active on August 2, 2026 (European Commission).

That sequence matters. Practices such as certain manipulative systems, social scoring, and some uses of biometric categorization are already prohibited. Providers and deployers cannot treat all outstanding guidance as a reason to postpone compliance with rules that are in force.

At the same time, the EU changed the timetable for high-risk systems. Following the AI Omnibus amendments that entered into force on July 27, 2026, rules for Annex III uses in fields such as employment, education, critical infrastructure, migration, and biometrics apply from December 2, 2027. Requirements for AI embedded in regulated products apply from August 2, 2028 (European Commission). The extension gives standards and support tools more time to mature, but it also leaves organizations with a preparation window rather than a waiver.

Transparency becomes a product requirement

Article 50 is among the most visible changes. Covered interactive systems must inform people that they are dealing with AI. Providers of systems that generate or manipulate audio, images, video, or text must support machine-readable detection. Deployers must clearly label deepfakes and certain AI-generated public-interest text.

For systems placed on the market before August 2, 2026, the machine-readable marking obligation has a limited transition until December 2, 2026; other Article 50 duties do not receive that general grace period (European Commission). A disclosure therefore cannot be a vague sentence buried in terms of service. It has to appear at the right moment, survive distribution across platforms, and remain understandable to the affected person.

The Commission’s voluntary transparency code and July 2026 guidelines provide practical detail on labels, marks, exceptions, and responsibility across the supply chain (European Commission). They reduce ambiguity, but they do not replace the binding regulation.

Foundation-model rules reach downstream

The EU AI Act Moves From Principle to Practice — supporting image
The EU AI Act Moves From Principle to Practice — supporting image

Providers placing general-purpose AI models on the EU market must maintain technical documentation, give downstream system providers information about capabilities and limits, adopt a policy for EU copyright compliance, and publish a sufficiently detailed summary of training content. Providers outside the EU generally need an authorized representative. Models classified as presenting systemic risk face additional evaluation, risk-mitigation, incident-reporting, and cybersecurity duties (European Commission).

The Commission began enforcing full compliance for post-August 2025 models in August 2026. Older models have until August 2, 2027. The General-Purpose AI Code of Practice offers one route to demonstrate compliance, but adherence is voluntary; the legal duties are not.

This structure makes information flow central. A company building a recruitment tool on a third-party model cannot assess risk without reliable model documentation. A model provider cannot anticipate every downstream use. Contracts, version records, evaluation results, and change notifications become part of the compliance architecture.

Enforcement will test consistency

The AI Office oversees general-purpose models and certain systems tied to their providers or to very large platforms. National market-surveillance authorities handle much of the remaining enforcement, and the European Data Protection Supervisor covers EU institutions. For Article 50 violations, fines can reach €15 million or 3% of worldwide annual turnover, subject to proportionality rules (European Commission). More serious prohibited-practice violations can carry higher ceilings under the Act.

The immediate compliance work is practical: map every system and role; classify uses; document data and testing; train staff; design notices; log model versions; create complaint and incident channels; and assign authority to suspend a system. Smaller firms will need templates, sandboxes, and harmonized standards that make those tasks achievable without turning compliance into a barrier only large incumbents can absorb.

The Act’s success will not be measured by the number of policy documents it produces. It will be measured by whether users can tell when AI shapes an interaction, whether high-risk deployments are auditable, whether violations are corrected consistently across member states, and whether lawful innovation remains possible. Europe has written the framework. The next evidence will come from enforcement.

Sources