The date arrived; the law did not arrive all at once

The whole AI Act did not begin to apply on 2 August 2026. That date opened a new enforcement phase: the Commission and national regulators gained powers to investigate and enforce several obligations that had followed different timetables. Prohibitions on certain practices have applied since February 2025; duties on providers of general-purpose AI models since August that year. Providers of models already on the market before 2 August 2025 have until 2 August 2027 to comply. From 2 August 2026, the Commission can use its full powers against those providers, while the Article 50 transparency obligations are enforceable. The Act is no longer just a Brussels timetable: authorities can request information, evaluate models and, within their remit, order measures or impose fines.

The phrase “the AI Act has entered into force” hides a practical question: which rule, for whom and under whose authority? The EU regulation began applying in stages after it entered into force in 2024. The amendment known as the AI Omnibus, effective from 27 July 2026, postponed the rules for high-risk systems in certain areas—employment, education, credit, critical infrastructure and other Annex III uses—until 2 December 2027. The rules for high-risk AI systems embedded in regulated products listed in Annex I will apply from 2 August 2028. By contrast, certain transparency rules and duties for general-purpose models are already enforceable.

This is not a distinction reserved for lawyers. Article 50 does not require a label on every AI output: it sets different duties according to who generates or publishes content and what kind of content is involved. They include informing people who directly interact with certain systems, marking certain synthetic outputs so they can be detected, and disclosing certain deepfakes and public-interest texts. An exception applies to text subject to human review or editorial control where a person is editorially responsible for publication. Systems generating synthetic audio, images, video or text that were already on the market before 2 August have until 2 December to meet the technical marking and detection duty under Article 50(2); that transition does not suspend the other transparency rules. Meanwhile, an organisation using AI to screen job applicants remains under the timetable for the high-risk block, not a universal August 2026 deadline.

One European regulator, several doors

The Commission’s AI Office supervises providers of general-purpose AI models, including those considered to pose systemic risks. It also has jurisdiction over certain systems built on those models when the system provider and model provider belong to the same undertaking, and over systems that constitute, or are integrated into, platforms or search engines designated as very large under the Digital Services Act. Article 75 sets exceptions and limits for certain systems, including some linked to regulated products and areas such as critical infrastructure, justice, law enforcement, border management and finance. Its jurisdiction covers the providers of those systems; it also covers deployers when they are themselves providers or belong to the same undertaking as the system provider. The AI Office is not the regulator for every system built on a general-purpose model. The Commission can request documents and information, seek model access for evaluations, order corrective measures and, where necessary, restrict a model’s availability. In investigations, it can inspect business premises and interview people who consent.

The rest of the map does not fit inside a single European office. National market-surveillance authorities supervise other categories of systems, including many obligations imposed on those who deploy or use them. The European Data Protection Supervisor is responsible for systems used by EU institutions and bodies. This division connects the European scale of certain models with regulators who know national sectors and markets. It also creates a coordination problem: a system may combine a general-purpose model developed by one company, a provider that adapts it and a public body that uses it. Jurisdiction depends on the relationship between those actors and the system’s particular purpose.

July’s amendment tried to remove part of that maze by centralising oversight at the AI Office for some systems built on general-purpose models. It did not abolish national enforcement. Where a system falls outside the categories centralised at EU level, the national regulator retains a central role. If a case also involves fundamental rights, data protection or sector-specific rules, other authorities may have relevant powers under separate laws. “The EU regulates” does not mean one body receives every complaint, gathers all evidence and issues every measure.

Fines are legal ceilings, not automatic receipts

For companies, the AI Act’s best-known maximums reach €35 million or 7% of worldwide annual turnover for certain prohibited practices, whichever is higher. For other listed breaches—including obligations on providers, deployers and transparency—the ceiling can be €15 million or 3%, again whichever is higher. Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in response to a request can attract a maximum of €7.5 million or 1% of turnover, whichever is higher; Article 75c adapts that rule for the AI Office within its remit. For small enterprises, including start-ups, the Regulation provides for the lower of the fixed amount and the relevant percentage; it also sets specific treatment for small mid-cap companies in certain infringements.

Those ceilings do not mean that every error attracts the maximum fine. The law directs authorities to consider the nature, gravity and duration of the breach, its consequences, the number of people affected, the operator’s size and turnover, its degree of responsibility and cooperation, and steps taken to reduce harm. For national infringements, each Member State must set the penalties and identify the authorities or courts that impose them, with procedural safeguards and judicial review. The AI Office also has a separate regime for general-purpose model providers under Article 101; Article 75c adapts Article 99 penalties to systems within its competence. The European Data Protection Supervisor has a distinct regime when the operator is an EU institution.

That architecture can produce one common law with different national rhythms and practices. The AI Act requires Member States to notify the Commission of their penalty rules and report annually on fines and related litigation. Those reports will help show how often fines are imposed, though a country’s aggregate figure will not tell the whole story: an investigated breach, a corrective order and a final fine are different outcomes.

The AI Office has also created channels for complaints from individuals and organisations, protected reports from people professionally connected to providers, and complaints by downstream providers using third-party general-purpose models. Filing a complaint does not automatically open proceedings: the Commission retains discretion to prioritise cases. For an affected person, that difference matters. A complaint button creates an entry point; it does not guarantee that a regulator can attribute the harm, obtain the necessary records or order an individual remedy.

The first test is institutional

In September, the European Artificial Intelligence Board discussed the Commission’s enforcement activities and priorities, the application of transparency rules and coordination among national authorities. That meeting shows the institutional work is under way; it is not a sanction decision and does not by itself prove that the rules are being applied uniformly.

Europe built a multi-level system because risks, models and uses do not all sit in the same place. The question in the coming months will not only be how many fines appear in a press release. It will be whether a complaint reaches the right regulator, whether authorities share evidence, whether a provider receives an intelligible order and whether that decision survives challenge. For the public, a visible label or a model’s withdrawal is more concrete than a regulation in the abstract. For someone who receives the label or suffers an automated decision, a competent authority and a route to review may matter more still.

The AI Act distributes its enforcement tools among Brussels, national supervisors and sector regulators. Its effectiveness will depend on whether that division produces timely, reasoned decisions that affected people can challenge and review. Europe has moved beyond the stage when announcing a regulation was enough. It must now show that a law spanning 27 jurisdictions can find, promptly and with public reasons, the office that has to act.

Sources