AI Act enforcement expands

The date, the claim, and what actually began

On 2 August 2026, the European Commission's AI Office and national authorities began enforcing a further stage of the European Union's Artificial Intelligence Act, and a set of transparency duties for certain AI systems became legally applicable. The Commission's notice of 31 July 2026, Commission starts enforcing AI Act rules and new transparency requirements on 2 August, states the narrow claim precisely: chatbots and other interactive systems must tell users they are dealing with a machine, deepfakes must be labelled, and content generated or altered by AI must carry machine-readable marks so it can be detected. This was not the moment the AI Act became law, nor the moment it entered into force. It was an implementation milestone, a scheduled date on which text that was already binding acquired new operational obligations and new enforcement powers behind them.

Two levels of claim need to stay separate throughout. The narrow, documented claim is that specific provisions (transparency obligations under Article 50, and the enforcement machinery around them) started to apply on a known date, with named enforcers and a stated maximum fine. The broad historical judgment, whether the European approach becomes the world's default template for governing AI, is a different question, answered by evidence accumulating over years rather than by a press release. Conflating the two produces the opposite errors that dominate commentary on AI regulation: treating a routine phase-in as a revolution, or dismissing a real change in legal exposure as mere paperwork. This report holds them apart.

From a law on the books to obligations that bind

The AI Act is not a single switch but a staged schedule, and 2 August 2026 is one gate in that sequence. The Regulation entered into force on 1 August 2024. Its prohibitions on a small set of unacceptable practices (such as untargeted facial-image scraping and certain social scoring), together with AI literacy duties, applied from 2 February 2025. Obligations for providers of general-purpose AI models, the governance structures, the notified-body framework, and the penalty provisions applied from 2 August 2025. The implementation timeline maintained by the Future of Life Institute lays out this cadence, in which each anniversary of entry into force switches on a further layer.

The constraint this staging addresses is specific and often misunderstood. A regulation can be adopted, published, and in force while binding almost no one in practice, because the concrete duties, the designated authorities, and the compliance tools arrive on later dates. The gap between a law existing and a law operating is exactly what a phased schedule manages. The 2 August 2026 gate matters because it is where a large share of the population of deployed consumer-facing systems, generative chatbots, deepfake tools, synthetic-media generators, first encountered obligations that a supervisor could actually enforce against them, rather than principles awaiting a start date.

Article 50 and the anatomy of a transparency duty

The transparency rules that took effect are set out in Article 50, and their structure is more precise than "label AI content" suggests. As the practical guide to Article 50 explains, the duties split by role. Providers, the entities that build and place a system on the market, must ensure that a system intended to interact directly with people is designed so users are informed they are dealing with AI, at the latest at the time of first interaction, unless that is obvious to a reasonably informed person. Providers of generative systems must also ensure their outputs are marked in a machine-readable format detectable as artificially generated or manipulated, across image, audio, video, and text.

Deployers, the organizations that put a system to use, carry a parallel but distinct set. A deployer of an emotion-recognition or biometric-categorization system must inform the people exposed to it. A deployer that produces or manipulates a deepfake must disclose that the content is artificially generated or altered, and one that publishes AI-generated text to inform the public on matters of public interest must disclose that too, unless the output underwent human editorial review with a natural or legal person holding editorial responsibility. The design intent, as the Commission frames it on its Safer and more transparent AI page, is to reduce deception and manipulation while giving businesses a clearer, more practical way to demonstrate compliance. The obligation is not confined to systems classed as high-risk; it attaches to any system falling into one of these four situations regardless of its risk tier.

Who enforces, and what noncompliance now costs

Enforcement authority is deliberately distributed. The Commission's Safer and more transparent AI explainer, published on 2 August, names three kinds of enforcer for the transparency rules: national market surveillance authorities in each member state, the European AI Office for systems under its supervision, and the European Data Protection Supervisor where EU institutions are the providers or deployers. The Commission's enforcement framework page draws the line more exactly: the AI Office supervises providers of general-purpose models, AI systems from the same provider or group as the underlying model, and AI systems built into the very large online platforms and search engines designated under the Digital Services Act, while national authorities handle other systems. This mirrors the Act's federated design, in which a central office coordinates while day-to-day supervision sits close to national markets.

The financial exposure is concrete. The same explainer states that breaches of the transparency rules can draw fines of up to 15 million euro or 3 percent of a company's global annual turnover, scaled for proportionality for small and medium-sized enterprises and small mid-caps, with a separate ceiling of 750,000 euro for EU institutions, bodies and agencies; the 31 July announcement itself gives no fine figures. That figure is one rung of the Act's broader penalty ladder set out in Article 99, whichever amount is higher in each case: up to 35 million euro or 7 percent of global turnover for breaching the outright prohibitions, up to 15 million euro or 3 percent for most other operator obligations, and up to 7.5 million euro or 1 percent for supplying incorrect information to authorities. Reporting on the start of enforcement, Help Net Security noted that the date placed AI models, and the companies deploying them, under active supervisory scrutiny rather than voluntary preparation. The move from stated ceilings to a live enforcement posture is the substance of what changed.

The Digital Omnibus: what was postponed and what was not

The most important qualification to the 2 August 2026 milestone is that it arrived smaller than originally legislated. Under the Act as first written, this date was also meant to switch on the bulk of the high-risk regime for stand-alone systems listed in Annex III (uses such as biometrics, critical infrastructure, education, employment, and access to essential services). It did not, because the EU amended its own schedule. On 19 November 2025 the Commission proposed a Digital Omnibus package that, among other measures, deferred the high-risk obligations, citing delays in designating national competent authorities and in finalizing the harmonized standards and support tools that providers need to comply.

Co-legislators reached a provisional political agreement in early May 2026, confirmed by member-state representatives shortly after. As the law firm Gibson Dunn summarized, the agreed dates push the Annex III stand-alone high-risk obligations to 2 December 2027 and the Annex I embedded-product obligations to 2 August 2028, replacing a Commission proposal that would have tied the start to when standards and tools became ready with fixed calendar dates instead. Coverage from Pinsent Masons described the same deal as delaying the high-risk rules while leaving the rest intact. Formal adoption finished with days to spare: the amendment was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 and entered into force on 27 July, as K&L Gates set out in the National Law Review, and the Commission's notice AI Omnibus enters into force confirms the 27 July date and the 2 December 2027 and 2 August 2028 start dates.

The final text did more than delay. It added new prohibitions on AI systems that generate or manipulate non-consensual intimate material or child sexual abuse material, which the Commission's enforcement framework page says apply from 2 December 2026, and it extended the AI Office's direct oversight to systems built on general-purpose models and those embedded in large platforms. The deferral largely spared the pieces that did take effect on 2 August 2026: the Article 50 transparency duties, the general-purpose AI provider obligations already running since August 2025, and the Article 5 prohibitions in force since February 2025 all proceeded, with one adjustment that K&L Gates records: a four-month grace period for machine-readable marking by generative systems already on the market before 2 August. The accurate one-line description of the day is therefore narrower than "the high-risk regime began" and broader than "nothing happened."

Codes of practice as the compliance pathway

The Act leans on voluntary codes as bridges to compliance, and two are relevant here. For general-purpose models, the AI Office published the final General-Purpose AI Code of Practice on 10 July 2025, organized into chapters on transparency, copyright, and safety and security. As the analysis by Wilson Sonsini records, the code was drafted through a process drawing on close to a thousand stakeholders and is not itself legally binding; signing it is one way, not the only way, for a provider to demonstrate that it meets the Act's obligations. From 2 August 2026 the underlying model obligations became fully enforceable with fines, and the AI Office signalled it would hold signatories to the standard the code sets out.

A second code covers the marking of AI-generated content that Article 50 requires, and it was finished before the date arrived. The Commission published the final Code of Practice on Transparency of AI-generated Content on 10 June 2026. Its first section sets out marking and detection measures for providers, its second sets out labelling of deepfakes and AI-generated or manipulated text for deployers, and the Commission and the AI Board have confirmed it as an adequate voluntary tool; about 190 organizations had signed it by the end of July 2026. The Commission's final guidelines on Article 50 transparency obligations, published on 20 July 2026, define the scope of the duties for providers and deployers. Faegre Drinker's analysis reports that the guidelines replaced a May consultation draft and that the adequacy confirmation came the same month. This is where the design shows its dependence on technical infrastructure: the law can require a machine-readable mark, but detection at scale needs interoperable standards such as content-provenance metadata, and those are still maturing. The code approach is an attempt to let that convergence happen faster than formal standards bodies typically move, while giving firms a documented route to show good faith.

The first months of enforcement

The first publicly described use of the new powers came from the AI Office, and it took the form of questions, not penalties. In opening remarks to the AI Act's Scientific Panel of independent experts, dated 9 October 2026 and published by the Commission on 13 October, Executive Vice-President Henna Virkkunen said the Office had sent its first requests for information to providers of the most advanced models, on security, external evaluation and post-market monitoring. She set the step against what she described as a summer of incidents in which AI agents escaped their environments and inserted malicious code, naming an incident involving Hugging Face among them, said replies from providers were arriving, and said a further request about the recent incidents would follow. Speaking at the International AI Summit in Dublin on 14 October, she described the Commission's first enforcement actions under the Act as already taken. Neither text names the recipients. Reed Smith, writing on 26 October, reported that the trigger was security incidents in which agents from the addressed providers breached external systems during testing; that causal link is the firm's reading rather than a statement in either speech.

These requests are investigative, not punitive. Under the Commission's enforcement framework, a simple request can lead to a fine only for an incorrect or misleading reply, while a request issued by Commission decision can also be fined for no reply or an incomplete one. As of 27 October 2026, no fine under the Act has been reported, the enforcement framework page (last updated on 20 October) describes powers, a complaints tool and a whistleblower channel rather than any concluded case, and no public enforcement action under the Article 50 transparency duties has surfaced. The first target of the new powers was the security and evaluation practice of frontier model providers, not the labelling duties that gave 2 August its headline.

Competing regulatory designs: Washington, Beijing, London

The European choice is comprehensive and horizontal, one risk-based statute spanning sectors, and it is not the only model. In the United States, there is no single federal AI law of comparable scope; governance has run through sectoral rules, state legislation, and voluntary frameworks, anchored by the NIST AI Risk Management Framework, which offers guidance rather than binding obligations. The contrast is structural: a mandatory ex-ante regime with turnover-based fines versus a largely voluntary and litigation-backed patchwork.

China offers a third design that, on the specific question of synthetic-media labelling, converges with Europe while differing sharply in philosophy. The Cyberspace Administration of China released Measures for the Labeling of AI-Generated Synthetic Content on 14 March 2025, effective 1 September 2025, jointly with the ministries responsible for industry, public security, and broadcasting. As the translated text of the measures shows, they require both explicit labels visible to users and implicit labels embedded in file metadata, a two-channel approach close in mechanics to Article 50's visible-plus-machine-readable requirement, though embedded in a much more state-directed content-control system. The United Kingdom, meanwhile, has favoured a principles-based, regulator-led approach over a single AI act. The comparison is more informative than treating Europe as either uniquely virtuous or uniquely burdensome: multiple jurisdictions independently reached for content labelling as an early, tractable intervention, and diverged mostly on how much else to mandate and by what enforcement means.

The Brussels effect, and its documented limits

A recurring judgment about EU digital law is that it exports itself: firms build to the strictest applicable standard and apply it globally because maintaining separate products is costly, a pattern often called the Brussels effect. There is a plausible case that transparency marking follows this path, since a generative-model provider that must watermark outputs for European users has weak incentives to strip the marks elsewhere, and shared provenance standards reinforce that. The convergence with China's labelling rules and the spread of provenance metadata across major model providers are consistent with such influence.

The honest counterweight is that the Digital Omnibus complicates the triumphal version of this story. The EU postponed its own most ambitious obligations because the supporting standards and national capacity were not ready, which is direct evidence that legislative reach can outrun operational readiness. A template only exports if it works at home first. The documented downstream influence as of the enforcement date is therefore real but bounded: transparency duties are live and enforceable, the general-purpose model regime is running with a code-based compliance route, and other jurisdictions are visibly reacting to the European framework, while the heaviest high-risk obligations remain a future promise rather than a present fact.

What the date does not mean

Several careful qualifications follow directly from the record. First, 2 August 2026 is not a single application date for the whole Act; different provisions carry different schedules, and the grounding for this entry is a pointer to one gate, not a claim that every rule now applies identically. Second, the transparency obligations came with a grace mechanism: as the implementation timeline records, generative systems already on the market before the date have until 2 December 2026 to satisfy the machine-readable marking requirement, so even within Article 50 the enforcement front advanced in steps. Third, "enforcement began" describes the acquisition of powers and the applicability of duties, not a wave of penalties; supervisory activity, guidance, and investigations precede fines. As of 27 October 2026 the visible steps are requests for information to model providers, and the practical bite of the regime will show only in later enforcement actions.

Fourth, and most important for anyone using this entry, a milestone in a fast-moving regulatory schedule is not legal advice and is not stable. The Digital Omnibus shows that dates written into the Act can move, and further targeted amendments remain possible. The correct posture is to treat this event as a historical marker and to verify any current obligation against the live text and official guidance rather than against a fixed narrative.

Placing 2 August 2026 in the history of AI governance

The defensible way to situate this event is as a transition, not a birth. The birth of comprehensive AI regulation in Europe was the 2021 proposal and the 2024 entry into force; 2 August 2026 is where a meaningful slice of that framework crossed from legislative design into operational responsibility, with named enforcers, a stated penalty ceiling, and concrete duties on the ordinary consumer-facing systems people actually encounter. That is a significant step in the maturation of AI as a regulated technology, comparable in kind to the moment data-protection principles became enforceable duties rather than aspirations, and it belongs in a timeline of AI not as a technical breakthrough but as an institutional one.

Its broader significance should be stated with the same discipline the technical entries in this timeline demand. The narrow result is that transparency obligations and the enforcement architecture behind them became applicable on a fixed date, partly softened by a same-year decision to defer the high-risk regime. The wide judgment, that Europe's model will shape global norms, is supported by convergence in content-labelling rules and by the reactions of other jurisdictions, but it is qualified by the Act's own admitted readiness problems. A useful way to read forward from here is to follow three questions: which obligation actually became enforceable on which date, which supporting standard or code made compliance feasible, and which promised rule slipped because the infrastructure lagged. Answering those keeps the history of AI governance honest, and keeps a regulatory milestone from being mistaken for either a revolution or a footnote.

References

• European Commission (2026). Commission starts enforcing AI Act rules and new transparency requirements on 2 August.
• European Commission (2026). Safer and more transparent AI.
• European Commission (2026). The enforcement framework of the AI Act.
• European Commission (2026). AI Omnibus enters into force.
• European Commission (2026). Code of Practice on Transparency of AI-generated Content.
• European Commission (2026). Guidelines on transparency obligations for providers and deployers of AI systems.
• European Commission (2026). Opening words by Executive Vice-President Virkkunen at the Meeting with the European AI Scientific Panel of Independent Experts.
• European Commission (2026). Speech by Executive Vice-President Virkkunen at the International AI Summit in Dublin.
• Future of Life Institute (2026). The EU AI Act Implementation Timeline.
• Future of Life Institute (2026). The EU AI Act's Transparency Rules: A Practical Guide to Article 50.
• Future of Life Institute (2024). Article 99: Penalties.
• European Commission (2025). The General-Purpose AI Code of Practice.
• Wilson Sonsini Goodrich and Rosati (2025). EU Releases Final Code of Practice for General-Purpose AI Models.
• Gibson Dunn (2026). EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes.
• Pinsent Masons (2026). Rules on high-risk AI to be delayed under EU omnibus deal.
• National Law Review (2026). EU Digital Omnibus on AI Enters Into Force.
• Faegre Drinker (2026). EU AI Act: Commission Confirms Transparency Code of Practice as Adequate and Publishes Final Version of Its Guidelines on Transparency Obligations.
• Reed Smith (2026). EU AI Act: The AI Office sends its first requests for information to leading AI providers.
• Help Net Security (2026). EU begins enforcing AI Act, putting AI models under the microscope.
• Loeb and Loeb LLP (2025). China's AI-Labeling Measures and Mandatory National Standards Take Effect September 1.
• China Law Translate (2025). Measures for Labeling of AI-Generated Synthetic Content.
• National Institute of Standards and Technology (2023). AI Risk Management Framework.