Fines for general-purpose AI models and new transparency duties became enforceable across the EU this week. The high-risk system rules meant to be the Act's centrepiece won't apply until December 2027.
The EU's Artificial Intelligence Act became law in August 2024, but most of it did nothing until national regulators and the European Commission's AI Office could actually investigate and fine someone. That changed on 2 August 2026, two days before this piece was filed. The Commission's own account is direct: enforcement powers over banned AI practices, obligations on general-purpose AI (GPAI) models and new transparency duties all "apply from 2 August 2026" — not the underlying bans, most of which predate this week, but the machinery to act on them.1
Three duties landed on schedule. Chatbots and other systems that talk to people must now say so; AI-generated images, audio and text must carry a machine-readable mark; and deepfakes must be disclosed as such.6 Separately, the Commission gained the power to fine providers of general-purpose AI models directly — a power written into the Act back in 2024 but deliberately switched off for exactly twelve months after the underlying GPAI obligations themselves began, on 2 August 2025.2 More than 180 organisations have already signed the Commission's voluntary code of practice on labelling AI-generated content, one way of showing compliance with the new transparency duties.7
The Act's most demanding chapter — the one requiring conformity assessments, technical documentation and human oversight for "high-risk" uses such as recruitment screening, credit scoring and law-enforcement tools — was due to apply from 2 August 2026 too. It doesn't. In November 2025 the Commission proposed a "Digital Omnibus" to defer it, citing unfinished technical standards; the European Parliament adopted the deal on 16 June 2026 by 423 votes to 57, and the Council of the EU gave final sign-off on 29 June.3 The resulting regulation entered into force on 27 July 2026 — six days before the old deadline.6
Standalone high-risk systems (Annex III) now have until 2 December 2027; systems built into regulated products such as medical devices and lifts (Annex I) have until 2 August 2028.3 The same package moves one thing forward, not back: a new ban on AI "nudification" tools and AI-generated child sexual abuse material, carrying the Act's highest fine tier, applies from 2 December 2026.3
Enforcement is split three ways. The AI Office, inside the Commission, polices general-purpose AI models directly, plus any AI system built by a GPAI provider on its own model and AI features embedded in the largest online platforms. National authorities police everything else operating in their own country. The European Data Protection Supervisor covers the EU's own institutions.1
That national layer is where the gap sits. Every member state was supposed to designate its market-surveillance and notifying authorities by 2 August 2025 — a full year before enforcement powers activated. As of 17 June 2026, only nine of the EU's 27 member states had fully done so; twelve had made partial progress, and six had designated no authority at all.5 European Commission Executive Vice-President Henna Virkkunen framed the switch-on as giving "innovators legal certainty while protecting the public interest."7 Whether the third of member states still without a functioning authority can deliver on that this month is untested.
No fine has yet been issued under either Article 99 or the GPAI-specific Article 101 — the powers are two days old at the time of writing, so there is no track record of how aggressively the AI Office or national authorities will use them.1 The Future of Life Institute's readiness count is seven weeks old; some of the twelve partially-ready states may have completed designation since. And the new December 2027 and August 2028 dates are fixed in law, but co-legislators tied the original high-risk timeline to harmonised technical standards that were not finished when the delay was agreed4 — a dependency that has already slipped once and could slip again.
The Parliament's own framing was practical: harmonised standards and compliance tools for high-risk systems were not ready, and fixed dates, it said, would give business "predictability and legal certainty" rather than a moving target.4 Industry groups that had long criticised the Act's original timeline broadly welcomed the change.9
Digital-rights group Liberties called the postponement a weakening of fundamental-rights safeguards due this month, warning high-risk systems "can continue operating without adequate safeguards" for longer.8 German MEP Sergey Lagodinsky called a related carve-out proposal "very dangerous," arguing sectoral product laws lack AI-specific safeguards.9