EU AI Act Enforcement Has Started: What Changed on 2 August 2026

On 2 August 2026 the EU AI Act stopped being a paper deadline. Article 50 transparency obligations now apply, the AI Office can fine general-purpose AI providers up to 3% of global turnover, and a little-noticed grace period closes on 2 December 2026.

The EU AI Act crossed from drafting into enforcement on 2 August 2026. Two distinct things happened on that date, and conflating them is the fastest way to misjudge your exposure.

The short answer: the Article 50 transparency obligations became directly applicable to providers and deployers, and the European Commission's AI Office acquired the power to investigate and fine providers of general-purpose AI models. The heavy high-risk regime did not arrive — the Digital Omnibus pushed it to December 2027 and August 2028. If you have been waiting for the high-risk deadline to start work, you have already missed a live obligation that applies to you regardless of risk tier.

What changed on 2 August 2026

What did not change is as important: standalone Annex III high-risk obligations remain deferred to 2 December 2027, Annex I embedded AI to 2 August 2028, and the national regulatory sandbox obligation to 2 August 2027.

The enforcement shift nobody priced in

The GPAI obligations in Chapter V have been legally binding since 2 August 2025. What they lacked was a regulator with teeth. Until 2 August 2026 the AI Office could ask, publish guidance, and negotiate — it could not compel.

That asymmetry ended. The AI Office can now:

• request documentation and information from GPAI model providers,
• conduct its own evaluations of models, including independent testing,
• require corrective measures — compliance actions, risk mitigation, market restriction, recall or withdrawal,
• impose fines of up to 3% of global annual turnover or €15 million, whichever is higher, under Article 101.

The Commission also opened the channels through which cases will actually reach it: an AI Act complaints tool, an AI Act Whistleblower Tool, and a dedicated complaints channel for downstream providers building on general-purpose models. That last one matters more than it sounds — it lets a company integrating a foundation model report the upstream provider's non-compliance directly to Brussels.

The four Article 50 obligations, precisely

Article 50 is the broadest-reaching provision in the entire Regulation, because it is risk-independent. It does not ask whether your system is high-risk. It asks what your system does.

1. Systems that interact with people (Art. 50(1)) — provider duty. Chatbots, voice assistants, AI agents and avatars must be designed so that a natural person is informed they are interacting with an AI system. The disclosure must be timely — before or at the start of the interaction. The only carve-out is where it is obvious to a reasonably well-informed person, plus the law-enforcement exemption.

2. Generative output marking (Art. 50(2)) — provider duty. Providers of AI systems generating synthetic audio, image, video or text must mark outputs in a machine-readable format, detectable as artificially generated or manipulated. The marking must be effective, reliable, robust and interoperable. This is the obligation with the December grace period.

3. Emotion recognition and biometric categorisation (Art. 50(3)) — deployer duty. Deployers must inform the natural persons exposed to the system, and comply with GDPR in parallel. Safety-protective uses such as drowsy-driver detection sit outside the disclosure duty.

4. Deepfakes and public-interest text (Art. 50(4)) — deployer duty. Deployers publishing deepfakes, or AI-generated text on matters of public interest, must disclose that the content is artificially generated or manipulated. Exemptions apply where content undergoes human editorial review with editorial responsibility, and for manifestly artistic, creative, satirical or fictional work — subject to proportionate disclosure that does not spoil the work.

Note the split: obligations 1 and 2 fall on providers, 3 and 4 on deployers. Most organisations are deployers, and most compliance programmes have been written as if the whole Article were a provider problem. See our breakdown of providers vs. deployers if you are unsure which you are.

The 2 December 2026 trap

The transitional period is the single most misread element of the August package.

The grace period until 2 December 2026 applies only to machine-readable marking, and only for generative AI systems already placed on the EU market before 2 August 2026.

Three consequences follow:

• A generative system launched on or after 2 August 2026 has no grace period. It must mark from launch.
• The other three Article 50 duties have no transitional period at all. Chatbot disclosure, emotion recognition notice and deepfake labelling were enforceable on 2 August.
• 2 December 2026 is also when the new Article 5 prohibition — on AI systems generating child sexual abuse material or non-consensual intimate imagery — becomes enforceable. For providers this bites beyond intended use: it reaches any system where such generation is a reasonably foreseeable and reproducible outcome without significant technical modification, and where the system lacks adequate safeguards to prevent it. That is a design-and-red-teaming obligation, not a policy statement.

What non-compliance costs

In each case the ceiling is the higher of the fixed sum and the percentage. For a company above roughly €500 million in turnover, the percentage is always the operative figure.

Full detail on the tiering and the SME caps is on our penalties page.

Who your regulator actually is

This is the practical question, and the answer is rarely Brussels.

• GPAI model providers answer to the Commission's AI Office, exclusively. This is a deliberately centralised regime.
• Everyone else — Article 50 duties, prohibited practices, and eventually the high-risk regime — answers to the national market surveillance authority of each Member State where the system is placed on the market or put into service.

Designation of those national authorities has been uneven across the 27 Member States. In practice this produces a patchwork: identical conduct may draw an inspection in one Member State and nothing in another, at least in the first enforcement cycle. That asymmetry is a reason to comply to the strictest national interpretation, not the most permissive — a single well-resourced regulator can set the de facto European standard, as happened repeatedly under the GDPR.

The Code of Practice: the closest thing to a safe harbour

The Commission published the Code of Practice on Transparency of AI-generated Content in June 2026 and confirmed it as an adequate means of demonstrating compliance with the Article 50 marking and labelling duties.

By the end of July 2026 roughly 190 organisations had signed. The Code has two sections:

• Section 1 — providers (provenance and marking requirements). Signatories include Aleph Alpha, Anthropic, Black Forest Labs, Cohere, Google, Meta, Microsoft, Mistral, OpenAI and Synthesia.
• Section 2 — deployers (visible labelling of deepfakes and public-interest AI text). Signatories include Bulgari, Fastweb, Getty Images, Iberdrola, Lenovo and Lufthansa.

Signing is voluntary and confers no legal immunity. But the asymmetry is real: a signatory implementing the Code has a documented, Commission-recognised compliance route. A non-signatory must construct and defend its own method in front of a market surveillance authority. Interoperable watermarking schemes such as Google's SynthID are the emerging technical baseline for Section 1.

What to do in the next 120 days

1. Inventory by function, not by risk tier. List every AI system that talks to a person, generates content, or infers emotions. Risk classification is irrelevant to Article 50 scope.
2. Split the inventory provider vs deployer. Obligations 1–2 versus 3–4 land on different legal entities, often within the same group.
3. Date every generative system. On the EU market before 2 August 2026 → marking due 2 December 2026. On or after → due now. Record the evidence for the date.
4. Ship the disclosures. In-interface chatbot notices, content labels, emotion recognition notices. These are already overdue if missing.
5. Decide on the Code of Practice. Sign it, or document why your alternative method meets Article 50 to the same standard.
6. Red-team against the new Article 5 prohibition before 2 December 2026 if you provide a generative image, video or audio model.
7. Identify your national market surveillance authority in each Member State where you operate, and check whether it has published enforcement priorities.

Our compliance checklist covers the full obligation set, and the transparency obligations pillar goes deeper on Article 50 scope and exemptions.

The road after August 2026

The deferrals granted by the Digital Omnibus bought time on the high-risk regime — roughly sixteen months for Annex III, two years for Annex I. They bought no time at all on transparency. Organisations that read the Omnibus as a general reprieve have misread it: the Regulation's broadest obligation is live, enforceable, and carries a 3% ceiling.

For the full picture of what the Omnibus changed, see our Digital Omnibus analysis and the AI Act deadline tracker.

Official sources

• European Commission — Commission starts enforcing AI Act rules and new transparency requirements on 2 August
• European Commission — Guidelines on transparency obligations for providers and deployers of certain AI systems, 20 July 2026
• European Commission — Code of Practice on Transparency of AI-generated Content
• European Commission — Transparency obligations under Article 50 of the AI Act (FAQ)
• Regulation (EU) 2024/1689 — Article 50, Article 99
• Regulation (EU) 2026/1744 (Digital Omnibus on AI) — published in the Official Journal 24 July 2026, in force 27 July 2026