EU AI Act Aug 2, 2026: What's Enforced, What's Delayed

Updated July 11, 2026 — three weeks out. The Digital Omnibus is now final: the European Parliament endorsed it on June 16 and the Council gave its last sign-off on June 29, 2026. That settles the question everyone has been asking us: August 2, 2026 is an enforcement date, not a compliance cliff. The Commission's power to fine GPAI providers switches on. Article 50 transparency obligations apply. High-risk Annex III obligations do not — they moved to December 2, 2027. The table below is the whole verdict; everything after it is what to do with your three weeks.

Obligation	Status on August 2, 2026
GPAI provider obligations (Arts. 53/55)	Already applied since Aug 2, 2025 — what activates now is enforcement: the Commission can investigate and fine up to €15M or 3% of global turnover
Article 50 transparency (chatbot disclosure, AI-content labeling)	Applies Aug 2, 2026 — machine-readable marking/watermarking has a grace period to Dec 2, 2026
Penalty framework (Arts. 99/101)	Operative — national authorities and the AI Office can investigate and sanction
High-risk Annex III obligations	Delayed to Dec 2, 2027 (Digital Omnibus, final June 29, 2026)
High-risk Annex I (embedded in regulated products)	Delayed to Aug 2, 2028
Prohibitions (Art. 5) and AI literacy (Art. 4)	In force since Feb 2, 2025 — unchanged

Last updated: July 11, 2026

What is the EU AI Act and when does it enforce?

The EU AI Act (Regulation (EU) 2024/1689) is the European Union's horizontal AI regulation, in force since August 1, 2024, with obligations entering effect in phases. It establishes a risk-based framework — categorizing AI systems as prohibited, high-risk, limited-risk, or minimal-risk — and assigns distinct obligations to providers (the developers placing AI systems on the market) and deployers (the organizations using them).

The official enforcement timeline

The Act's phased enforcement schedule — sourced from the official implementation timeline and confirmed by the European Commission's AI Act page — is as follows:

Date	What enters force
August 1, 2024	Regulation in force
February 2, 2025	Prohibitions on certain AI practices (Chapter II) and AI literacy requirements
August 2, 2025	General-Purpose AI (GPAI) model provider obligations, governance rules, notified bodies, confidentiality provisions, and the penalty regime
August 2, 2026	GPAI enforcement powers activate and Article 50 transparency applies. High-risk Annex III obligations, originally due here, were moved to Dec 2, 2027 by the Digital Omnibus
August 2, 2027	Article 6(1) and corresponding requirements; GPAI providers with models placed on the market before August 2, 2025 must reach full compliance
December 2, 2027 / August 2, 2028	Final obligations for legacy high-risk systems in regulated sectors

The most common misunderstanding we encounter — including in the legal and compliance press — is the belief that GPAI obligations or penalties first enter force in August 2026. They did not. Both have been in force since August 2, 2025.

What specifically becomes enforceable on August 2, 2026?

August 2, 2026 is when the "remainder of the Act" — most provisions not already in force — becomes applicable. Operationally, the four things that change are:

High-risk AI system obligations apply to most new deployments. Per the implementation timeline, high-risk AI systems operators "must comply with requirements if they place systems on the market with significant design changes from this date onward." Article 6(1) high-risk systems remain on the later 2027 schedule.
Codes of conduct and codes of practice formally apply. Voluntary codes referenced in the Act move from preparation to operational status.
National competent authorities reach full operational capacity. Member states' designated AI supervisory authorities — already designated under earlier phases — assume their full enforcement remit.
Most deployer obligations for high-risk systems become enforceable. Including human oversight, monitoring, transparency to affected persons, and incident reporting where high-risk systems are used.

What were the August 2, 2025 obligations enterprises should already have implemented?

Because the most expensive misconception is "we have until next August," it is worth being precise about what should already be in place. As of August 2, 2025:

GPAI model providers (the foundation-model vendors themselves, including OpenAI, Anthropic, Google, Meta, Mistral) must meet transparency, documentation, and copyright-compliance obligations and provide public summaries of training data. Providers of GPAI models with systemic risk have additional obligations including model evaluation and serious incident reporting.
Governance authorities are operational. The European AI Office supervises GPAI; national competent authorities began their phased ramp-up.
Penalty framework is enforceable. Article 99 of the Act establishes administrative fines up to €35 million or 7% of global annual turnover (whichever is higher) for prohibited-practice violations; up to €15 million or 3% for other violations of the Act; up to €7.5 million or 1% for supplying incorrect or misleading information to authorities.

For enterprise deployers of AI (which most companies are), the practical 2025 implication was the AI literacy requirement under Article 4 (entered force February 2, 2025) and the upstream obligation to know which GPAI models are in your supply chain and what their published compliance posture says.

Provider vs. deployer: which obligations apply to your organization?

The EU AI Act distinguishes between providers (parties that develop AI systems or place them on the market) and deployers (parties using AI systems in the course of their professional activity). Most enterprises are deployers, sometimes providers, and the obligations differ materially.

Role	Typical organization	Core obligations
Provider	AI vendor, foundation-model lab, in-house ML team shipping an AI product	Risk management, technical documentation, data governance, transparency to deployers, post-market monitoring, serious incident reporting, conformity assessment for high-risk
Deployer	Enterprise using AI in operations	Human oversight, monitoring, transparency to affected persons, log retention, suspending systems in case of risk, cooperating with authorities
GPAI provider	OpenAI, Anthropic, Google, Meta, Mistral, etc.	Technical documentation, copyright compliance, training data summary; systemic-risk providers add model evaluation and incident reporting

The single most common error in enterprise compliance posture is the assumption that "we are a deployer, not a provider, so most of the Act doesn't apply to us." It applies. It is just different obligations.

What will regulators look at first?

Nobody knows with certainty what the first wave of enforcement actions will target. But based on how national competent authorities are staffing and what their initial work programs prioritize, the early sweep is very likely to focus on what is easy to check from the outside.

1. AI inventory and credibility

The equivalent of GDPR Article 30 records of processing. The first regulator request will almost certainly be "show us the AI systems you operate or deploy." Organizations that cannot produce that list in a week look negligent.

2. Risk-tier classification

The Act's risk taxonomy — prohibited, high-risk, limited-risk, minimal-risk — is the lingua franca of every regulator conversation. If you cannot say which of your use cases sit in which tier, you cannot have a credible discussion.

3. Documentation for high-risk systems

The Act (Annex IV) specifies high-risk technical documentation requirements: intended purpose, data governance, technical architecture, monitoring and human oversight, risk management. Most enterprises did the work; few wrote it down in a form a regulator would accept.

4. GPAI provider diligence

You are not the provider. You are expected to have evidence that you evaluated the provider's compliance posture before adopting their model. This is the AI-era version of vendor risk management.

5. AI literacy

Article 4 of the Act requires AI literacy among staff who interact with AI systems on behalf of the organization. There is real ambiguity about what "sufficient" means, but "we have not done anything" is not a tenable position.

What are the four traps enterprises are walking into?

These are the patterns surfacing repeatedly in compliance gap assessments. None are exotic.

Trap 1: Treating GPAI provider obligations as someone else's problem. The obligations apply to the model provider; that does not get you off the hook for evidence of vendor diligence.

Trap 2: Confusing GDPR compliance with AI Act compliance. They overlap (data minimization, lawful basis, transparency) but the AI Act has its own risk framework, documentation requirements, and enforcement bodies.

Trap 3: Mistaking policy documents for compliance. A binder of well-written AI policies that no one can demonstrate actually shapes daily behavior is worth almost nothing in front of a regulator. The Act is increasingly interpreted in operational terms.

Trap 4: Underestimating cross-border reach. If you operate AI systems that affect EU residents — including remote-work scenarios, customer service, recruiting tools — you fall under the Act regardless of headquarters location.

How do I prepare for August 2, 2026 in the next three weeks?

You will not solve EU AI Act compliance in three weeks. You can materially reduce risk surface and put yourself in a credible posture.

Weeks 1–3: Inventory and classify

Stand up a real AI inventory. Live, attested, listing every AI system in operation with owner, purpose, model provider, data flow, and risk-tier classification.
Classify every entry against the Act's risk tiers. Prohibited use cases get an immediate cessation plan. High-risk get an owner and documentation deadline. Limited-risk get transparency obligations confirmed.
Identify exposure to EU residents — a legal exercise as much as a technical one. Get DPO and counsel in the room.

Weeks 4–6: Document what already exists, build what does not

For each high-risk use case, produce the Annex IV documentation pack: intended purpose, data sources and governance, architecture, monitoring and human oversight, risk assessment, accuracy and robustness evaluation.
For each GPAI model in use, produce the provider diligence pack: provider's published technical documentation, compliance summaries, your evaluation against the use case, the controls wrapping it.
Stand up an AI incident-reporting workflow. The Act requires reporting of serious incidents involving high-risk systems.

Weeks 7–10: Operationalize and rehearse

Run a mock regulator request. Pick one high-risk use case. Have a colleague act as regulator. Time how long each artifact takes to produce. The first run is painful; the third is the one a regulator should see.
Brief your executive team and board. Not on legal text — on operational posture: what you have, what you do not, residual risk, next 90 days.
Lock in the evidence layer. Whatever combination of tools and processes produced the documentation has to keep producing it on an ongoing basis with minimal manual effort.

What does "good" look like on August 2, 2026?

You should be able to answer, on demand:

How many AI systems do we operate or deploy, across which jurisdictions, and what is the classification of each against the Act's risk tiers?
For our top ten highest-risk use cases: where is the documentation, who owns it, when was it last reviewed?
For our top five GPAI models in use: where is the provider diligence, and what is our contractual posture if the provider's compliance status changes?
For the last 30 days: what AI-related incidents occurred, how were they triaged, and what would we report to a supervisory authority if asked?
For the next board meeting: can we produce a one-page EU AI Act readiness summary that the audit committee chair will sign off on?

A closing reality check

European regulators have signaled, in public statements and private conversations, that the first enforcement wave will not be designed to make examples. It will test market maturity and send calibrated signals. Organizations caught in that wave will mostly be those whose gaps were obvious from the outside — the inventory they did not have, the documentation they could not produce, the AI literacy training they never ran.

This deadline is meetable. It is not a deadline you can sleep through.

FAQ

When does the EU AI Act actually start enforcing?

The EU AI Act enforces in phases. Prohibited practices and AI literacy took effect February 2, 2025. GPAI obligations, governance, and the penalty regime took effect August 2, 2025. The remainder of the Act (excluding Article 6(1)) applies August 2, 2026. Article 6(1) and legacy GPAI obligations apply August 2, 2027.

What are the EU AI Act penalty amounts?

Article 99 of the Act establishes tiered administrative fines: up to €35 million or 7% of global annual turnover for prohibited-practice violations; up to €15 million or 3% for other violations; up to €7.5 million or 1% for supplying incorrect information to authorities. These took effect August 2, 2025.

Do GPAI obligations take effect August 2, 2026?

No — this is a common misconception. GPAI model provider obligations took effect August 2, 2025. GPAI providers that placed models on the market before August 2, 2025 have until August 2, 2027 to reach full compliance.

What is the difference between an EU AI Act provider and a deployer?

A provider develops an AI system or places it on the market under its own name. A deployer uses an AI system in the course of professional activity. Most enterprises are deployers; some are also providers. Obligations differ materially — providers carry risk management, technical documentation, and post-market monitoring duties; deployers carry human oversight, monitoring, and transparency-to-affected-persons duties.

Does the EU AI Act apply to US-headquartered companies?

Yes, if the AI system is placed on the EU market, used in the EU, or its output is used in the EU — regardless of where the provider or deployer is headquartered. The extraterritorial reach is comparable to GDPR. US-headquartered enterprises with EU operations, EU customers, or EU employees affected by AI systems fall in scope.

What is the European AI Office?

The European AI Office is the European Commission body that supervises implementation of the EU AI Act, particularly for general-purpose AI models. It issues guidance, codes of practice, and operates the AI Act Service Desk. It works alongside national competent authorities in each member state.

What documentation do high-risk AI systems require under the EU AI Act?

Annex IV of the EU AI Act specifies technical documentation requirements for high-risk AI systems, including: general description and intended purpose, detailed design, monitoring and post-market plan, risk management documentation, data governance, accuracy and robustness, human oversight measures, and a system performance assessment.

What ACTUALLY changes on the August 2026 deadline vs. the December 2027 delay?

August 2, 2026 still matters — codes of practice formally apply, national competent authorities reach full operational capacity, and the Commission’s GPAI enforcement powers switch on. What it no longer brings is high-risk deployer enforcement; the Digital Omnibus moved that to December 2, 2027. What the Digital Omnibus (adopted December 2024) shifted is the application date for Annex III high-risk system provisions — the eight use-case categories like employment, education, and essential services — from August 2, 2026 to December 2, 2027. Read that as breathing room on one specific track, not a blanket extension. If your high-risk system sits in Annex I (product-safety regulated sectors), you are still on the original timeline.

Does the Digital Omnibus extension apply to our use case?

Only if your high-risk system falls under Annex III — recruitment and HR, education and vocational training, essential private and public services, law enforcement, migration and border control, administration of justice, biometric categorization, or critical infrastructure. Annex I high-risk systems (those embedded in products already regulated under EU product safety law — medical devices, machinery, toys, aviation) remain on the August 2, 2026 schedule. GPAI obligations, prohibited practices, AI literacy, governance, and penalties are unaffected — those have all been live since 2025.

We're a non-EU company. Are we still in scope?

Yes if the AI system is placed on the EU market, used in the EU, or its output is used in the EU. Article 2 establishes extraterritorial reach comparable to GDPR — your headquarters location does not matter. A US-based recruiting tool that screens EU candidates is in scope. A model trained in Tel Aviv and served via a US API to an EU bank's customer flow is in scope. If you cannot rule it out cleanly with counsel, assume in scope and build the documentation pack.

What's the worst-case penalty if we miss the deadline by 3 months?

Article 99 fines are the published ceiling — up to €35 million or 7% of global annual turnover for prohibited-practice violations, up to €15 million or 3% for other violations, up to €7.5 million or 1% for supplying incorrect information. Realistically, the first enforcement wave is calibrated to test market maturity rather than make examples, but missing by three months with no credible inventory and no Annex IV documentation puts you in the negligence bucket regulators will use to set precedent. The fine is one risk; the reputational damage of being a named first-wave case is the larger one.

Can we use voluntary codes of practice to demonstrate good faith?

Yes — adherence to approved codes of practice is explicitly recognized in the Act as a way to demonstrate compliance with specific obligations, particularly for GPAI providers. Signing a code does not substitute for the underlying obligations, but it gives you a defensible posture during an investigation and signals to regulators that you are engaging with the framework in good faith. The European AI Office is actively endorsing codes — pick the ones relevant to your role (provider vs. deployer) and document your adherence.

If we classified our system as "limited risk" but a regulator disagrees, what's the process?

A national competent authority can request the technical documentation supporting your classification and, under Article 79, can require a market surveillance assessment if they believe your system has been misclassified. If they conclude it is high-risk, you receive a corrective order — typically to bring the system into compliance with high-risk obligations within a defined window — and only escalate to fines if you fail to cooperate. The leverage is in your documented reasoning: a written classification rationale referencing the Act's risk criteria is the difference between a 60-day remediation window and an enforcement action.

Where to take this next

If you want a faster path — including a working AI inventory, a risk-tier classification of your current use cases, and an Annex IV documentation pack template — that is exactly the conversation our team is running this month. Book 30 minutes with our compliance team and we will walk through your environment with you before August 2 becomes a deadline you wish you had taken more seriously.

EU AI Act August 2, 2026: What's Enforced, What's Delayed