Europe’s fight to regulate AI models moved from paper to practice on 2 August 2026, when the European Commission’s AI Office and national authorities began enforcing the AI Act.
On the same date, new transparency rules took effect, requiring certain AI systems to tell users when they’re interacting with AI and when content has been generated or altered by it.
Under these rules, chatbots have to identify themselves as automated systems, deepfakes need a label, and machine-made or edited content must carry machine-readable marks so it can be detected automatically.
Companies that ignore these obligations risk fines of up to €15 million or 3% of their worldwide annual turnover, whichever is higher.
Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, called AI “a transformative technology” with benefits for people and businesses, but warned that the most advanced models “create risks on an entirely new scale.”
The goal of these measures, according to the Commission, is to cut down on deception and manipulation and help people make informed choices. They’re also meant to give businesses clearer obligations and a practical way to show compliance.
These enforcement powers could add fuel to an already tense relationship between major U.S. companies like OpenAI, Anthropic and Google, and the European Commission, which has been pushing hard on tech sovereignty.
GPAI providers face new scrutiny
The AI Office’s new enforcement power covers providers of general-purpose AI (GPAI) models, the versatile systems behind many tools and services, including AI agents.
The Commission said providers of the most advanced GPAI models must address risks of large-scale harm, including chemical, biological, radiological and nuclear incidents, loss of control, cyber offence, harmful manipulation and threats to fundamental rights.
“All providers of GPAI models must document certain information and provide it to competent authorities or downstream providers. They must also put in place a copyright policy and publish a sufficiently detailed summary of the content used to train their models,” the Commission explained.
Industry compliance and what’s still ahead
Alongside enforcement, the Commission released a first list of over 180 organizations that signed the Code of Practice on transparency of AI-generated content, a voluntary framework meant to give companies a concrete way to show they’re meeting the labelling and marking requirements.
The Code of Practice itself is voluntary, though the transparency obligations behind it are legal requirements under Article 50 either way. Signing gives providers a documented way to demonstrate compliance.
Not every part of the AI Act is moving at the same speed. The AI Omnibus, a package of amendments to the Act, pushed back the rules for high-risk AI systems to 2 December 2027, and those for high-risk systems built into regulated products to 2 August 2028. The same package moves faster on the harm side. From 2 December 2026, it bans AI systems that generate non-consensual sexually explicit content or child sexual abuse material.
The Commission has already used other EU digital laws to scrutinise risks associated with generative AI. In January 2026, the Commission opened a formal investigation into X under the Digital Services Act over its Grok tool, after manipulated sexually explicit images and possible child sexual abuse material appeared on the platform.
Who enforces what
Enforcement responsibility is split among several bodies. The AI Office handles general-purpose AI models directly, with power to request technical documentation, run evaluations, demand corrective steps and issue fines.
National competent authorities take on other AI systems operating within their borders. The European Data Protection Supervisor oversees compliance among EU institutions themselves.
Virkkunen said the Act gives “innovators legal certainty while protecting the public interest,” and called enforcement “an important step towards AI that people and businesses can understand and trust.”
Not everyone is convinced this will change much. In a May interview with Help Net Security at the Span Cyber Security Arena conference, Antonija Vojnović, Governance, Risk and Compliance Department Manager at Span, said she isn’t convinced the AI Act will bring major change. She argued that awareness of how AI tools handle data may matter more than the rules themselves.