The EU AI Act Is Now Enforceable: What August 2 Changed

• Also see: The Model Context Protocol explained
• Also see: Let the states keep writing AI law
• Also see: The first hiring-algorithm lawsuits

For two years, the EU AI Act existed mostly as a document: ambitious, comprehensive, and unenforceable. That changed on 2 August 2026. The AI Office, the European Commission’s dedicated enforcement body, now has the power to investigate, audit, and fine. The transparency obligations in Article 50 are live for anyone placing AI systems on the European market. The era of voluntary compliance is over.

The enforcement timeline matters because the obligations arrived in phases, and the most consequential ones are only now becoming real. The Act entered into force in August 2024. Prohibited-practice rules applied from February 2025. General-purpose AI model obligations followed in August 2025. August 2026 is the inflection point: Article 50 transparency duties are enforceable, GPAI provider obligations are fully in force, and the AI Office can impose penalties.

flowchart LR
    A["August 2024"] --> B["AI Act enters into force"]
    B --> C["February 2025"]
    C --> D["Prohibited-practice rules apply"]
    D --> E["August 2025"]
    E --> F["GPAI obligations apply"]
    F --> G["August 2 2026"]
    G --> H["Article 50 transparency duties live"]
    H --> I["AI Office can fine providers"]
    I --> J["December 2026"]
    J --> K["Intimate-material prohibitions"]
    K --> L["December 2027"]
    L --> M["High-risk Annex III duties"]
    M --> N["August 2028"]
    N --> O["Product-embedded systems fully in scope"]

The penalty structure is tiered by severity, and the numbers are large enough to matter even to the biggest platforms. Prohibited practices carry the maximum: 35 million euros or 7 percent of global annual turnover, whichever is higher. Breaches of GPAI provider obligations carry 15 million euros or 3 percent. Violations involving other AI systems carry 7.5 million euros or 1 percent. The turnover-based calculation means the fines scale with size, which is deliberate: the Act is designed so that a violation costs a meaningful fraction of revenue regardless of whether the company is a startup or a hyperscaler.

type: bar
title: Maximum AI Act fines by violation tier
x: Prohibited practices, GPAI breaches, Other systems
Max fine million euros: 35, 15, 7.5

The provider-versus-deployer distinction is the structural key to the whole Act. Providers, the organizations that develop and place AI systems on the market, bear the primary compliance burden: risk assessments, technical documentation, data governance, and post-market monitoring. Deployers, the organizations that use AI systems in their operations, face a lighter but still real set of obligations: transparency to affected persons, human oversight where required, and reporting of serious incidents. The distinction means that a company using a third-party model is not off the hook, but its obligations are different from and generally less than those of the company that built and released the model.

Article 50 is where the Act touches ordinary users directly. It requires that people interacting with an AI system be told they are interacting with an AI, not a human. It requires that synthetic or manipulated content be marked as such, including deepfakes. It requires disclosure when AI-generated text is published in the public interest, such as news content. These are not abstract obligations; they are product requirements that engineering teams must implement in the next quarter.

The AI Omnibus, passed in parallel, simplified some of the Act’s more burdensome provisions, particularly for high-risk systems, in response to industry pressure that the original text was too rigid. The Omnibus did not change the penalty tiers or the August 2026 timeline. It adjusted documentation requirements and extended certain transition periods. The signal was that the EU is willing to streamline implementation without weakening enforcement.

EU AI Act 2026: what it means for youPlays from YouTube when you press play

The calendar ahead is crowded. December 2026 brings prohibitions on AI-generated intimate material, a response to the deepfake abuse that has driven legislative urgency across member states. December 2027 extends full high-risk obligations to Annex III systems, the categories like employment, education, and law enforcement where the Act’s requirements are most demanding. August 2028 completes the phase-in for AI systems embedded in regulated products, from medical devices to vehicles.

For anyone shipping AI in Europe, the practical checklist is clear. If you are a provider, confirm your GPAI obligations are met: systemic-risk assessments for the largest models, technical documentation, and incident reporting channels. If you are a deployer, implement Article 50 transparency: chatbot disclosure, synthetic-content marking, and deepfake labeling. If you are a startup, the Omnibus transition periods may buy you time, but the August 2026 enforcement date does not wait for business plans.

The cosmic microwave background metaphor is apt. The signal was always there, faint and easy to ignore. Now that we know where to look, it is unmistakable. The AI Act is enforceable, the fines are real, and the timeline is fixed. The only question left is whether you are ready.

---

By OMMAIS: LongCat 2.5 Preview Free using OpenCode’s cloud API