The Day the AI Act Got Teeth
For the past year, the EU AI Act existed in an awkward halfway state: obligations were technically in force, but the enforcement machinery to punish violations was not. That ended on 2 August 2026. According to the European Commission, its AI Office — alongside national authorities — began enforcing the Artificial Intelligence Act that day, at the same moment a new set of transparency obligations took effect.
The shift is best understood as a change in kind, not degree. As legal analysts summarizing the milestone put it, what changed was the move from guidance to enforcement — the Commission going from advisory capacity to compulsory authority with penalty powers. The rules did not become stricter overnight. The consequences for ignoring them became real.
Two distinct things activated on the same date: transparency duties that touch nearly every consumer-facing AI product, and financial penalty authority over the companies that build foundation models. Both matter well beyond Europe’s borders.
What Article 50 Now Requires
The transparency obligations live in Article 50 of the AI Act, and they break into four concrete duties. Per the EU AI Act’s own summary of Article 50, providers of chatbots and virtual assistants must ensure users are informed they are interacting with an AI, and that disclosure must happen at the latest at the time of the first interaction. Providers of generative AI systems must mark their outputs — audio, image, video, and text — in a machine-readable format detectable as AI-generated.
The remaining two duties fall on deployers rather than providers. Deployers using emotion recognition or biometric categorization must inform the people exposed to it, and deployers must disclose AI-generated deepfakes and text published to inform the public on matters of public interest, except where human editorial responsibility applies. The provider-versus-deployer split matters in practice: the company that builds a model and the company that uses it to publish content carry different obligations.
The Act carves out narrow exemptions — obvious AI use, law-enforcement-authorized systems, assistive-only editing, and artistic, satirical or fictional works — but the default is disclosure. And there is a second clock worth marking: while Article 50 obligations commenced on 2 August 2026, existing generative AI systems have until 2 December 2026 to meet the marking requirements. New systems must comply now; legacy systems get a short runway.
Advertisement
The Fining Power Over Foundation Models
The second activation is aimed higher up the supply chain. As of 2 August 2026, the Commission holds active penalty authority over general-purpose AI (GPAI) model providers. The GPAI obligations themselves have been in force since August 2025 — what was missing was the ability to punish non-compliance, and that is what switched on.
The powers are substantial. From that date, the Commission and its AI Office can request documentation, run technical evaluations of models, demand compliance and risk-mitigation measures, restrict or withdraw a model from the EU market, and issue fines. The financial teeth sit in Article 101: penalties of up to 3% of global annual turnover or €15 million, whichever is higher, for intentional or negligent violations, false information, or failure to comply with a Commission request.
There is a grace period for incumbents. GPAI models placed on the market before 2 August 2025 must be brought into compliance by 2 August 2027 — a two-year window for legacy foundation models. But models launched after that date, and any provider that fails a documentation or evaluation request, are exposed now.
What This Means for Non-EU Builders and Resellers
The AI Act is extraterritorial by design: obligations attach when AI output reaches EU users, regardless of where the developer sits. For builders and content producers outside the bloc, that turns the 2 August activation into an operational deadline, not foreign news.
1. Audit every consumer-facing AI touchpoint for disclosure now
If you operate a chatbot, voice agent, or generative tool that any EU user can reach, the direct-interaction disclosure duty applies to you today. Inventory every interface, confirm each one tells the user it is AI at first contact, and document it. This is the lowest-effort, highest-exposure obligation — a missing disclosure banner is a visible, easily-caught violation.
2. Ship machine-readable marking before the 2 December legacy deadline
Any generative system you run needs to mark its outputs in a machine-readable, detectable format. New systems must do this now; existing ones have until 2 December 2026. Treat that date as a hard engineering deadline — implement the marking pipeline (watermarking or provenance metadata) and verify it survives your output path rather than assuming a vendor handles it.
3. Map your GPAI exposure if you build on or resell foundation models
If your product wraps or resells a general-purpose model into the EU, you inherit documentation and compliance obligations backed by Article 101 fines. Identify which foundation models you depend on, confirm your provider is audit-ready, and get contractual assurances that they will meet Commission documentation and evaluation requests. Their non-compliance can become your market-access problem.
4. Separate your provider duties from your deployer duties
Because Article 50 splits obligations between providers and deployers, the first governance task is classifying your own role for each AI feature. Where you build the model you carry marking and disclosure duties; where you merely deploy someone else’s for deepfakes or public-interest text, different duties apply. Getting this mapping right determines exactly which controls you must own.
The Bigger Picture
The 2 August activation matters because it converts the EU AI Act from a document into a regime with consequences — and because those consequences reach far past Europe. A transparency rule enforced across the EU’s single market, backed by turnover-scaled fines, becomes a de facto global standard the same way GDPR did: not because every country adopts it, but because the cheapest path for a global product is to build to the strictest market and ship that everywhere. For builders and resellers outside the EU, the lesson of the day the Act got teeth is that “we don’t operate in Europe” is rarely true for anything reachable over the internet. The obligations follow the output, the fines follow the obligations, and the compliance clock is already running.
Frequently Asked Questions
What changed on 2 August 2026, exactly?
Two things activated on the same date. The European Commission’s AI Office, alongside national authorities, began enforcing the Artificial Intelligence Act and a new set of transparency obligations took effect. The rules did not become stricter — the Commission moved from advisory capacity to compulsory authority with penalty powers, so the consequences for ignoring them became real.
What are the fines, and who can be fined?
Penalty authority over general-purpose AI model providers is now active, with fines of up to 3% of global annual turnover or €15 million, whichever is higher, for intentional or negligent violations, false information, or failure to comply with a Commission request. The Commission can also request documentation, run technical evaluations, and restrict or withdraw a model from the EU market. Models placed on the market before 2 August 2025 have until 2 August 2027 to be brought into compliance.
Does a non-EU company have to comply?
Yes, where its output reaches EU users. Under Article 50, chatbot and virtual-assistant providers must inform users they are interacting with an AI at the latest at the time of first interaction, and generative systems must mark outputs in a machine-readable format detectable as AI-generated. Existing generative systems have until 2 December 2026 to meet the marking requirement; new ones must comply now.
Sources & Further Reading
- Commission Starts Enforcing AI Act Rules and New Transparency Requirements on 2 August — European Commission
- Transparency Obligations for Providers and Deployers (Article 50) — EU Artificial Intelligence Act
- EU AI Act 2026: GPAI Enforcement and 3% Fines Begin — Beam AI
- EU AI Act Enforcement Phase Begins — Wilson Sonsini
