EU AI Act: What Actually Starts on August 2, 2026 | GPAI Enforcement and the High-Risk Delay

What August 2, 2026 means for the EU AI Act

The EU AI Act is the EU's comprehensive AI regulation, which entered into force on August 1, 2024. It sorts AI into four levels of risk and attaches different obligations to each level. August 2, 2026 was set from the outset as the date the law becomes applicable in principle. But as the European Commission itself writes, it comes "with some exceptions" — not everything starts on this date.

One thing shifted right before the deadline. The "AI Omnibus" regulation, which simplifies the AI Act, entered into force just six days earlier on July 27, 2026, and rewrote some of the dates.

What begins on August 2, 2026

Two things start moving on this date. The first is the transparency obligations in Article 50 — telling people they are dealing with AI, and marking generated content. The second is enforcement. The Commission's AI Office and the Member State authorities formally took up responsibility for implementing, supervising, and enforcing the Act.

This is the change that matters most in practice. The obligations for GPAI models had existed since August 2, 2025 — but an obligation existing and an authority being able to punish you are two different things. From August 2, the AI Office can request technical documentation, evaluate models, require corrective measures, and issue fines. The stretch where rules existed but went unenforced is over.

What does not begin on August 2, 2026

Knowing what does not start keeps you from over-preparing. Obligations for "high-risk AI" — hiring, credit, education, critical infrastructure, the uses with heavy consequences for people's lives — do not start on August 2. Standalone high-risk AI (Annex III) moved to December 2, 2027, and high-risk AI embedded in products (Annex I) to August 2, 2028.

The stated reason for the extension is to let supporting tools such as standards reach companies before the obligations bite. The substance of the obligations did not disappear. Only the start date moved. The background to the delay is covered in detail in our article on the EU AI Act Omnibus.

The ninth prohibition — AI that generates non-consensual sexual imagery or CSAM, the so-called "nudification" apps — also lands in December 2026 rather than August 2. Prohibitions 1 through 8 have been in effect since February 2025.

What the transparency obligations actually require

The transparency obligations are nothing like the heavy apparatus required of high-risk AI. They amount to making it clear that this is AI — that is all. But the scope is broad, and most businesses offering AI-powered services fall inside it. The obligations split between providers (those who build) and deployers (those who use).

Chatbots have to be designed so people know it is AI

Article 50(1) requires providers of AI systems that interact directly with people to design and develop them so the person is informed they are interacting with an AI system. There are two exceptions. One is where this is obvious to a natural person who is reasonably well-informed, observant and circumspect. The other covers AI systems authorised by law to detect, prevent, investigate, or prosecute criminal offences, subject to appropriate safeguards for third parties' rights and freedoms — though systems available to the public for reporting a criminal offence are carved back in. The second is aimed at law enforcement, so only the first is relevant to ordinary businesses. For an AI chat window on your own site, stating it outright beats leaning on the exception.

The timing of the notice is fixed too. The information under paragraphs 1 to 4 must be provided in a clear and distinguishable manner at the latest at the time of the first interaction or exposure. Not mid-conversation, and not buried in the terms of service — at the entrance.

Generated content has to carry a machine-readable mark

Paragraph 2 requires providers of AI that generates synthetic audio, image, video, or text to mark the outputs in a machine-readable format so they are detectable as artificially generated or manipulated. General-purpose AI systems are named as included. The implementation detail worth noticing: what is required is an embedded mark a machine can read, not a human-visible "AI generated" label.

Paragraph 4 falls on the using side. Deployers who generate or manipulate image, audio, or video content constituting a deepfake must disclose that it was artificially generated or manipulated. The builder marks; the user discloses. Two layers.

To help with this, the European Commission is preparing a Code of Practice on marking and labelling AI-generated content, along with transparency guidelines. The code is positioned as a voluntary tool to guide providers and deployers of generative AI toward compliance. Not mandatory — but useful to work from.

The code of practice and the guidelines are both in English and both long. If you only need to pull the relevant provisions accurately, converting the web page to Markdown first moves faster.

Free ToolURL to Markdown ConverterConvert any public web page URL to Markdown. Preserves headings, tables, lists, and links — perfect for LLM and RAG preprocessing, research notes, and archiving web articles.Try it now →

GPAI enforcement and how large the fines are

The other pillar is enforcement against general-purpose AI models. GPAI means the foundational models usable across a wide range of purposes, and they sit underneath a great many AI systems in the EU. Supervisory power in this area was concentrated in the Commission's AI Office rather than left with Member States. The AI Omnibus explicitly reinforces the AI Office's powers and centralises oversight, a design meant to avoid divergence across Member States.

Fines cap at EUR 15 million or 3% of worldwide turnover, whichever is higher

Fines against providers of GPAI models sit in Article 101. The ceiling is 3% of annual total worldwide turnover in the preceding financial year or EUR 15,000,000, whichever is higher. The Commission imposes them, and the triggers are intentional or negligent infringement, plus failure to supply requested documents or information, supplying misleading information, failing to comply with a requested measure, and refusing the Commission access to a model for evaluation.

There are procedural protections. Before imposing a fine, the Commission must communicate its preliminary findings to the provider and give it an opportunity to be heard. Decisions are reviewable by the Court of Justice of the European Union with unlimited jurisdiction to cancel, reduce, or increase the fine. The structure is not "maximum penalty out of nowhere" but a sanction arrived at through exchange.

Enforcement runs through the AI Office and national authorities

Enforcement is two-tiered. The AI Office holds direct enforcement powers over GPAI models; Member State authorities supervise everything else. What the AI Office can do: request technical documentation, evaluate models, require corrective measures, and impose fines.

The institutional build-out continues. In July 2026 the Commission published an action plan on cybersecurity and AI, stating it will launch a call to increase EU capacity to evaluate AI models before they are placed on the market. That capacity is expected to be operational by 2027. August 2 is the starting line for enforcement, not the finished form of it.

Who outside the EU is caught, and what to check now

For a business based outside the EU, the first fork is whether you are in scope at all. The Act draws the line not by where you are but by where the output is used, so having no EU establishment does not put you outside it.

Regional differences are worth holding in view as well. In the United States, the federal AI Kill Switch Act is still at the introduction stage, and at state level the Colorado AI Act was repealed before it took effect. On the evidence available, the EU is ahead in reaching the stage of full application of a comprehensive law. Other jurisdictions do have binding AI legislation, though, so reading this as "only the EU" would not be accurate.

If "the output is used in the Union," it applies

Article 2(1) sets out scope in seven parts, and (c) is the one that reaches businesses in third countries. It states plainly that providers and deployers established or located in a third country are covered where the output produced by the AI system is used in the Union. Providers placing AI models on the EU market are covered by (a) regardless of where they sit.

Conversely, a purely domestic service with no EU users and no output used in the EU is not directly covered. The whole judgment starts from one question: is anyone in the EU using the output of your AI?

Three things to check right now

If you might be in scope, three items rank highest as of August 2. High-risk obligations have until December 2027, so there is no need to rush those.

• Do you run a chatbot that reaches users in the EU? If so, check that the entry point makes clear an AI is responding
• Are you distributing AI-generated content into the EU? If so, check whether you can apply machine-readable marking
• Does the AI you use qualify as GPAI? If so, confirm with the provider whether they are meeting the transparency and copyright-related obligations

The third gets overlooked. Even if you do not build models, the provider's compliance status feeds directly into whether your own service keeps running. Rather than leaving it to the provider, put it on the checklist at contract renewal.

The Commission's AI Act pages and guidelines are all in English and substantial in volume. If you only want to skim the provisions you need, converting the page to Markdown before handing it to an AI preserves the heading and list structure and improves accuracy. Copying from the screen tends to drag in navigation and decoration, so cleaning it down to body text first is the safer route.

Free ToolURL to Markdown ConverterConvert any public web page URL to Markdown. Preserves headings, tables, lists, and links — perfect for LLM and RAG preprocessing, research notes, and archiving web articles.Try it now →

Conclusion: the one thing to verify is whether your output is used in the EU

August 2, 2026 is the day the EU AI Act moved from regulation on paper to regulation that gets enforced. That does not mean heavy obligations landed all at once. What actually started is transparency obligations and the enforcement machinery. The high-risk obligations, the ones that cost companies the most, slipped to December 2027 and August 2028. For a business outside the EU, the first thing to establish is whether your AI's output is used inside the Union. Start and stop there. If the answer is yes, chatbot notices and marking of generated content are enough to begin with, and high-risk design work can wait. When you go read the provisions or the Commission's explanations yourself, converting to Markdown first keeps the article numbers intact.

Free ToolURL to Markdown ConverterConvert any public web page URL to Markdown. Preserves headings, tables, lists, and links — perfect for LLM and RAG preprocessing, research notes, and archiving web articles.Try it now →