EU Begins Enforcing AI Act Rules for Model Providers and AI Transparency

The European Commission's AI Office and national authorities begin enforcing the EU AI Act on August 2, and new transparency rules for chatbots, deepfakes and AI-generated content take effect the same day, the Commission announced. For enterprises, this is the point where the AI Act moves from guidance documents to a regulator that can ask questions and act on complaints. It applies to companies that build general-purpose models and, through the transparency rules, to many more that simply deploy AI to customers or employees in the EU.

What starts on August 2, 2026?

Two things change at once, according to the Commission's announcement, republished by 1848 on July 31.

First, enforcement. The AI Office can now enforce the rules for providers of general-purpose AI (GPAI) models, including models used inside AI agents. Those obligations have applied since August 2025. All GPAI providers must document certain information for regulators and downstream companies, adopt a copyright policy and publish a summary of their training content. Providers of the most capable models, which the Act treats as posing systemic risk, carry extra duties covering risks such as cyber offense, loss of control and threats to fundamental rights.

Second, transparency. Chatbots and other interactive AI systems must tell users they are dealing with AI. Deepfakes must be labeled, and AI-generated or altered content must carry machine-readable marks. Enforcement of the Act's prohibited practices, such as manipulative systems and social scoring that threatens people's rights, also begins.

Who enforces the AI Act, and how can problems be reported?

Responsibility is split. The AI Office handles transparency and prohibited-practice rules for AI systems offered by the same company that provides the underlying GPAI model, and for systems built into very large online platforms or search engines designated under the Digital Services Act. National authorities cover other AI systems, and the European Data Protection Supervisor covers EU institutions, according to the Commission's release. The Commission called on member states to properly designate and resource their authorities.

The AI Office has opened three reporting channels: a complaint tool, a whistleblower tool and a channel for downstream companies to report on GPAI model providers. A scientific panel of 60 independent experts will support enforcement.

Penalties for transparency breaches can reach €15 million or 3% of global annual turnover, whichever is higher, Holistic AI noted in a July 28 summary.

How many companies have signed the transparency code?

The Commission published a first list of more than 180 organizations that have signed its Code of Practice on Transparency of AI-Generated Content, which sets out how to meet the marking and labeling rules. Its digital strategy site named model providers including Anthropic, Google, Meta, Microsoft, Mistral and OpenAI, and deploying companies including Getty Images, Iberdrola, Lenovo and Lufthansa. The code is voluntary, but the Commission describes it as a predictable route to showing compliance.

What was delayed, and what was not?

The high-risk rules most enterprises worried about did not arrive on August 2. The AI Omnibus, Regulation (EU) 2026/1744, entered into force on July 27 and moved obligations for stand-alone high-risk systems, such as AI used in hiring, credit and education, to December 2, 2027. High-risk AI built into regulated products moved to August 2, 2028, the Cloud Security Alliance summarized on August 1.

The same note stressed what continues: transparency and labeling duties, GPAI provider obligations and the prohibited-practice rules in force since February 2025. Generative AI tools already on the market before August 2 have until December 2, 2026 to meet the machine-readable marking requirement.

What should enterprise AI teams do now?

Check customer-facing AI first. Any chatbot, voice agent or content tool used with EU users should disclose that it is AI, and generated images, audio and video should be labeled. These are the rules now live.

Ask model providers for their GPAI documentation. Downstream companies are entitled to certain information from GPAI providers, and the AI Office now has a channel for complaints if it is not forthcoming.

Use existing frameworks. ADP's Amber Eshelman, senior director of global data governance, advised teams building AI governance to "do a lot of reading," pointing to the NIST AI framework, ISO's AI certification and the EU AI Act in a AI Connect webinar on protecting sensitive data from LLMs. Teams that treat governance by design rather than as a blocker will find the new rules easier to absorb.

The next markers are December 2, 2026, when the marking grace period ends and new prohibitions on AI-generated intimate imagery and child sexual abuse material apply, and the first enforcement actions the AI Office chooses to take.

Frequently asked questions

What AI Act rules apply from August 2, 2026?

Transparency obligations for interactive AI, deepfakes and AI-generated content, plus Commission enforcement of rules for general-purpose AI model providers and of prohibited practices.

Were the EU AI Act high-risk rules delayed?

Yes. The AI Omnibus, in force since July 27, 2026, moved stand-alone high-risk obligations to December 2, 2027 and rules for AI in regulated products to August 2, 2028.

Who enforces the AI Act?

The European Commission's AI Office handles general-purpose AI providers and some related systems, while national authorities enforce the rules for most other AI systems.

Filed under: AI Governance & Trust, Security & Fraud