EU AI Act Enforcement Is Live: Who Is Exposed Now?

EU AI Act enforcement is no longer a deadline on the calendar. The European Commission says its AI Office and national authorities began enforcing the law on August 2, 2026. The practical change is already visible: businesses, rights holders, workers, and downstream AI providers now have live routes for complaints, whistleblower reports, and disputes about general-purpose AI models.

The distinction still matters. Providers of general-purpose AI (GPAI) models have been legally bound since August 2, 2025 to publish training-content summaries, respect European copyright rules, document their systems, and manage systemic risk. What changed in August 2026 is the regulator's ability to compel evidence, order corrections, evaluate models, and impose fines. The Commission's enforcement announcement confirms that the preparatory year is over.

What switched on August 2

The AI Office can now demand documentation showing that a model complies with the transparency, copyright, safety, and security duties in Chapter V. It can conduct technical evaluations, enlist outside experts, order a provider to close a compliance gap, require mitigation of a systemic risk, restrict a model, or withdraw it from the EU market.

Those powers sit inside a broader AI Act enforcement framework shared by the Commission, national market-surveillance authorities, and the European Data Protection Supervisor. The AI Office leads on GPAI providers and on certain AI systems built on those models. National authorities handle much of the enforcement against deployers and other AI systems.

The Commission also activated three reporting routes. A general complaints tool lets affected people and organizations report suspected breaches. A whistleblower tool accepts protected reports from people with inside information. A separate channel lets downstream providers complain when the company supplying an integrated GPAI model is not providing the information or support required by Articles 53 to 55. That last channel matters because it gives application developers a direct route to the regulator when a model vendor leaves them unable to meet their own duties.

TECHi's earlier reporting on the EU's disclosure rules for AI agents covers the user-facing side of the same date. This article focuses on the model providers underneath those products and the buyers that depend on them.

Transparency rules now travel with enforcement

August 2 also brought Article 50 into application. Chatbots and other interactive AI systems must tell people when they are dealing with AI rather than a human. Deepfakes must be labeled. Providers of systems that generate or alter text, images, audio, or video must support machine-readable detection and marking where the provision applies.

The Commission's Article 50 guidance includes a narrow transition for systems placed on the market before August 2, 2026. Those systems have until December 2, 2026 to comply with the marking and detection obligation. That is not a general postponement of transparency duties, and it does not delay GPAI enforcement.

The Commission said more than 180 organizations had signed the Code of Practice on transparency of AI-generated content when enforcement began. Signing gives companies a practical route for showing how they intend to comply, but the Code does not replace the law or create immunity from investigation.

Four ways a GPAI provider can be fined

Article 101 gives the Commission four distinct routes to a penalty. A provider can be fined for breaking the substantive GPAI obligations. It can be fined for supplying incorrect, incomplete, or misleading information in response to a request. It can be fined for refusing access to a model for an evaluation. It can also be fined for failing to carry out an ordered corrective measure.

The ceiling is 3% of total worldwide annual turnover for the preceding financial year or €15 million, whichever is higher. For a large model provider, the turnover figure is the meaningful one because it attaches to the whole company's revenue, not the revenue of one model. A business with $10 billion in annual revenue faces a theoretical ceiling of $300 million.

That ceiling is not a forecast of the first penalty. The Commission must consider the nature, gravity, and duration of a breach, the provider's cooperation, and proportionality. There is no public GPAI fine yet that shows how aggressively those factors will be applied.

Signing the GPAI Code of Practice can still help. The Code gives providers a structured way to demonstrate compliance, and the AI Office has said adherence can reduce administrative burden and improve predictability. It remains voluntary. A provider that signs only selected chapters cannot present that choice as full coverage, and a signature does not stop the Commission from enforcing obligations that the provider failed to meet.

Which models are already inside the net

The timeline creates two populations of models.

Any GPAI model placed on the EU market on or after August 2, 2025 has been subject to the obligations from the day it entered the market. Those models are now enforceable. This group includes frontier releases, enterprise variants, and open-weight models launched during the past year, although some open-source providers qualify for exemptions from specific documentation duties.

Models that were already on the EU market before August 2, 2025 have until August 2, 2027 to reach compliance. They are not permanently exempt. The different deadlines create a quiet risk for product teams: replacing an older model with a successor released after the cutoff can move an application onto the enforceable track even when the customer contract and product name barely change.

Systemic-risk rules add another layer. A model trained with more than 10^25 floating-point operations is presumed to have systemic risk unless the Commission decides otherwise. Providers of those models face additional evaluation, incident-reporting, cybersecurity, and risk-mitigation duties. A provider must notify the Commission when its model meets the threshold or otherwise qualifies as systemically risky.

Providers established outside the European Union generally need an authorized representative in the bloc before placing a GPAI model on the market. For a US or Chinese lab, that representative is more than a mailing address: it is the legal point through which documentation requests and enforcement communications can be served.

What enforcement looks like in practice

The early system is likely to run on documents before it runs on headline fines. Requests for technical documentation, copyright policies, training-content summaries, risk assessments, and incident reports are faster to issue than a full technical evaluation. A weak or misleading response creates a separate enforcement problem even if the underlying model ultimately passes review.

Code signatories have an established set of commitments against which the AI Office can monitor them. Non-signatories still have to satisfy the statute, but they must explain their chosen compliance method without the Code's shared template. That makes procurement claims such as “AI Act ready” less useful than the underlying artifacts and the exact Code chapters a provider signed.

The complaint channels make the system less predictable for model companies. Copyright owners can point regulators toward disputed training practices. Employees can report internal safety evidence. Downstream providers can document missing technical information that prevents them from completing their own risk work. The Office still chooses what to investigate, but the flow of evidence no longer depends entirely on its own monitoring.

The EU's later Digital Omnibus changes have caused confusion about the timetable. The Commission's current implementation overview says the amended schedule pushes Annex III high-risk system rules to December 2027 and product-embedded high-risk rules to August 2028. Those changes did not undo the August 2026 enforcement date for GPAI obligations or the Article 50 transparency requirements now in force.

What builders and buyers should check now

For companies building on top of these models, enforcement changes procurement and continuity planning more than day-to-day engineering.

Map when every production model was placed on the EU market. A model released before August 2025 may remain on the 2027 runway, while its newer replacement may already be enforceable.

Check which chapters of the GPAI Code of Practice the provider signed. Transparency, copyright, safety, and security commitments should be examined separately rather than compressed into a single yes-or-no answer.

Request the compliance artifacts that should already exist: training-content summaries, technical documentation, copyright policies, risk assessments, incident-reporting processes, and the identity of the EU authorized representative where required. Teams that keep structured release records for AI changes will recognize the operational lesson. The record has to exist before the regulator or customer asks for it.

Review indemnification, regulatory-change, and service-continuity clauses. If the Commission restricts a model or orders a corrective change, downstream products inherit the disruption even when they did nothing wrong.

Test substitution before it becomes urgent. Agent stacks with runtime control hooks can change models with less rework than hard-wired integrations. Architecture teams should be able to answer a direct question: if this model became unavailable in the EU within 30 days, what would break, and how long would replacement take?

What remains unsettled

The enforcement machinery is live, but its practical severity is still untested. The Commission has not published a GPAI penalty that turns the 3% ceiling into a reliable expectation. Court challenges will eventually define how far the AI Office can push its interpretation of documentation, copyright, model access, and systemic risk. National enforcement may also vary as authorities build staff and procedures.

The direction is clear even while those questions remain open. Europe has moved from asking model providers to prepare to asking them to prove compliance on demand. For labs, the risk now sits in the gap between a public assurance and the evidence behind it. For customers, the safest response is to verify the model, the release date, the provider's exact commitments, and the exit plan before the first regulator's letter arrives.