Europe Starts Enforcing Key Provisions of the AI Act

Key Takeaways

• AI Act Enforcement Has Begun: As of Aug. 2, 2026, the European Commission's AI Office and national authorities have begun enforcing key provisions of the EU AI Act, moving parts of the framework from implementation planning to active regulatory oversight.
• New Transparency Rules Are Now Mandatory: Certain AI systems, including chatbots, must disclose when users are interacting with AI, while deepfakes and AI-generated or AI-altered content must be labeled and include machine-readable markers.
• General-Purpose AI Providers Face New Obligations: Providers of general-purpose AI models must meet documentation, copyright, and training-data transparency requirements, with additional risk management obligations applying to models deemed to pose systemic risks.
• Enforcement Is Shared Across Multiple Authorities: Oversight is divided among the AI Office, national competent authorities, and the European Data Protection Supervisor, supported by new complaint, whistleblower, and reporting tools.
• Some AI Act Requirements Remain Ahead: While transparency and GPAI enforcement are now underway, rules for high-risk AI systems have been postponed until Dec. 2, 2027, with certain regulated products following in 2028.

Deep Dive

On Aug. 2, the European Commission's AI Office, working alongside national authorities, began enforcing key provisions of the AI Act. The same date also marked the start of new transparency obligations requiring certain AI systems to disclose when users are interacting with artificial intelligence rather than a human being. AI-generated or AI-altered content must now carry machine-readable markers that make it easier to detect, while deepfakes (images, audio, or video) must be clearly labeled.

The requirements are easy enough to summarize, but their significance lies elsewhere. For much of the past two years, the AI Act has existed as a destination toward which companies could point while compliance teams built roadmaps and lawyers debated interpretations. Aug. 2 turned parts of that roadmap into active regulatory terrain. The conversation is no longer about what Europe intends to require. It is about what regulators can now enforce.

That shift extends well beyond the labels consumers will begin seeing. The Commission's AI Office now has authority to enforce the AI Act's obligations for providers of general-purpose AI models, which are defined as the broad foundation models that underpin chatbots, coding assistants, enterprise applications, and the growing class of AI agents designed to perform complex tasks across multiple domains.

Those providers must maintain technical documentation, supply required information to competent authorities and downstream developers, implement copyright policies, and publish sufficiently detailed summaries describing the content used to train their models. None of those obligations will attract the same public attention as a chatbot identifying itself as AI. They may ultimately matter more. Modern AI systems have become so deeply embedded in software ecosystems that accountability often depends less on what users see than on whether the organizations building these models can explain what they created, how they trained it, and what obligations travel with it downstream.

Europe has reserved its greatest scrutiny for the largest models. Providers whose general-purpose AI models present systemic risks face additional obligations aimed at preventing harms whose scale would once have belonged almost exclusively to national security planning. The AI Act identifies risks associated with chemical, biological, radiological, and nuclear incidents, cyber offense, harmful manipulation, loss of control, and threats to fundamental rights. The Commission also points to concerns that have become increasingly prominent over the past year, including risks to European cybersecurity and the possibility of advanced AI systems operating outside meaningful human oversight.

The architecture for enforcing those rules reflects the complexity of the technology itself. The AI Office will oversee AI systems supplied by the same providers that develop the underlying general-purpose models, as well as systems integrated into very large online platforms and very large online search engines designated under the Digital Services Act. National competent authorities will supervise other AI systems operating within Member States, while the European Data Protection Supervisor will oversee AI systems used by EU institutions and agencies.

Whether that structure proves effective will depend on something less dramatic than the legislation itself. The Commission acknowledged that enforcement ultimately rests on Member States designating national authorities with sufficient resources to carry out the work. Regulatory ambition has always been easier to legislate than regulatory capacity.

The Act's prohibitions also move into the enforcement phase. Regulators can now act against AI systems that manipulate people, exploit vulnerabilities in harmful ways, or engage in prohibited forms of social scoring that threaten fundamental rights. To support those efforts, the AI Office has introduced new reporting mechanisms, including a public complaint tool, a secure whistleblower channel for individuals working with AI providers, and a dedicated reporting process for downstream developers who believe providers of general-purpose AI models have violated their obligations. The Commission says information submitted through those channels will be handled confidentially.

Scientific expertise is becoming part of the enforcement machinery as well. A newly established Scientific Panel of 60 independent AI experts has already held its first meeting, and the AI Office has appointed Professor Alessandro Abate of the University of Oxford as Lead Scientific Adviser. His role spans model evaluation, testing, innovation, and scientific advice on general-purpose AI, underscoring how regulation of frontier AI increasingly requires technical judgment alongside legal authority.

Not every part of the AI Act arrived this week. The recently adopted AI Omnibus postponed the application of rules governing high-risk AI systems until Dec. 2, 2027, while requirements covering high-risk AI integrated into regulated products will not apply until Aug. 2, 2028. The Omnibus also introduced new prohibitions targeting AI systems that generate non-consensual sexually explicit content and child sexual abuse material, provisions scheduled to take effect on Dec. 2, 2026.

The staggered timeline reflects a recognition that regulating AI is less like throwing a switch than building a legal infrastructure while the technology itself continues to change beneath it. Some obligations become enforceable now, while others remain on the horizon because legislators concluded that the framework needed more time to meet the pace of implementation.

Henna Virkkunen, the European Commission's Executive Vice-President for Tech Sovereignty, Security and Democracy, described the beginning of enforcement as an important step toward AI that people and businesses can understand and trust while providing innovators with greater legal certainty.

There is a temptation to view Aug. 2 as another compliance milestone, one more date to add to already crowded regulatory calendars. It is something narrower and, for that reason, perhaps more consequential. Europe has reached the point where artificial intelligence is no longer governed chiefly by aspirations, consultations, or draft obligations. The rules are no longer waiting for the technology to catch up. The technology is now expected to answer to the rules.

‍The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.