EU AI Act Enforcement: August 2026 Rules and Deadlines

The EU AI Act became broadly applicable on August 2, 2026, bringing Article 50 transparency requirements and stronger regulatory enforcement into effect. The European Commission’s AI Office and national authorities can now enforce applicable provisions, while general-purpose AI model requirements that started in 2025 have entered their full Commission enforcement phase.

The regulatory timetable changed shortly before the main application date. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was signed on July 8, 2026, published in the Official Journal on July 24, 2026, and entered into force on July 27, 2026. The amended rules moved specified high-risk AI requirements to December 2, 2027, and August 2, 2028.

Article 50 transparency requirements now cover AI interaction notices, deepfake disclosures, public-interest AI text disclosures, and machine-readable marking of synthetic content. Providers of relevant generative AI systems placed on the market before August 2, 2026, receive a limited transition period for the Article 50(2) machine-readable marking requirement until December 2, 2026.

Companies can face fines of up to €35 million or 7% of worldwide annual turnover for prohibited AI practices. Other operator violations, including Article 50 transparency failures, can reach €15 million or 3% of worldwide annual turnover.

Bright Defense supports companies preparing for AI compliance through Security Assessments, Continuous Compliance, Penetration Testing, risk assessments, and policy support.

EU AI Act Rules Now Applying After August 2, 2026

The EU AI Act’s main application date has passed, and Article 50 transparency requirements and regulatory enforcement are now active. The Digital Omnibus changed several later deadlines without postponing the broader August 2, 2026 application date.

Providers of interactive AI systems must tell people when they are interacting directly with AI unless that fact is obvious from the circumstances and context. The requirement covers systems such as chatbots and other interactive AI services.

Providers of systems that generate synthetic audio, images, video, or text must make covered outputs detectable in a machine-readable format where Article 50(2) applies. The technical method must meet the statutory requirements for effectiveness, interoperability, and reliability within current technical limits.

Deployers face separate disclosure duties for deepfakes, emotion recognition, biometric categorization, and certain AI-generated or manipulated public-interest text. Public-interest text can qualify for an exception when it has undergone human review or editorial control and a natural or legal person holds editorial responsibility.

The European Commission published final Article 50 transparency guidelines on July 20, 2026. These guidelines clarify which providers and deployers fall within the disclosure rules and how the requirements apply to interactive systems and AI-generated content.

A separate Digital Omnibus amendment adds new prohibited AI practices from December 2, 2026. The provisions cover specified AI systems that generate or manipulate realistic non-consensual intimate material involving an identifiable person and AI systems connected to child sexual abuse material under the conditions set out in the amended Article 5.

EU AI Act Timeline From 2021 Through 2028

The EU AI Act now follows a confirmed phased timetable extending through August 2028. The Digital Omnibus replaced several original high-risk deadlines shortly before the main 2026 application date.

1. April 21, 2021: The European Commission proposed the Artificial Intelligence Act.
2. December 9, 2023: The European Parliament and Council reached a political agreement.
3. March 13, 2024: The European Parliament adopted the legislation.
4. May 21, 2024: The Council formally approved the AI Act.
5. July 12, 2024: Regulation (EU) 2024/1689 was published in the Official Journal.
6. August 1, 2024: The AI Act entered into force.
7. February 2, 2025: Prohibited AI practices and AI literacy provisions started to apply.
8. August 2, 2025: Governance provisions and obligations for general-purpose AI models started to apply.
9. November 19, 2025: The Commission proposed the Digital Omnibus on AI.
10. May 7, 2026: Parliament and Council reached a political agreement on the AI amendments.
11. June 10, 2026: The Commission published the Code of Practice on Transparency of AI-generated Content.
12. June 16, 2026: The European Parliament approved the Digital Omnibus agreement.
13. June 29, 2026: The Council formally adopted the legislative act.
14. July 7, 2026: The Commission published its Action Plan on Cybersecurity and Artificial Intelligence.
15. July 8, 2026: Regulation (EU) 2026/1744 was signed.
16. July 20, 2026: The Commission published final Article 50 transparency guidelines.
17. July 24, 2026: Regulation (EU) 2026/1744 was published in the Official Journal.
18. July 27, 2026: The Digital Omnibus on AI entered into force.
19. August 2, 2026: The AI Act reached its general application date. Article 50 transparency obligations became applicable and Commission enforcement of GPAI obligations began.
20. December 2, 2026: The Article 50(2) transition period ends for covered generative AI systems placed on the market before August 2, 2026. The new Article 5 prohibitions concerning specified non-consensual intimate material and child sexual abuse material start to apply.
21. August 2, 2027: Providers of GPAI models placed on the market before August 2, 2025, reach their compliance deadline. The revised national AI regulatory sandbox deadline falls on the same date.
22. December 2, 2027: Requirements for high-risk systems classified under Article 6(2) and Annex III start to apply.
23. August 2, 2028: Requirements for high-risk AI systems classified under Article 6(1) and Annex I start to apply.

Companies Covered By The EU AI Act

The EU AI Act applies to providers, deployers, importers, distributors, product manufacturers, and other operators connected to AI systems or models used in the European Union. Territorial coverage can reach organizations outside the EU when they place AI systems or GPAI models on the EU market or when AI system output is used within the Union.

The regulated roles include:

• Providers: Organizations that develop an AI system or GPAI model, or have one developed, and place it on the market under their name or trademark.
• Deployers: Organizations using an AI system under their authority in a professional context.
• Importers: EU entities placing AI systems from third-country providers on the EU market.
• Distributors: Businesses supplying AI systems within the EU supply chain.
• Product Manufacturers: Companies placing products containing AI systems on the market under their own name or trademark.
• Authorized Representatives: EU-based representatives acting for providers located outside the Union.

The Act contains defined exclusions covering military, defense, and national-security uses. Certain scientific research and development activities receive exclusions, while personal non-professional use falls outside the definition of a deployer.

Minimal-risk AI remains largely outside mandatory AI Act requirements. Common examples can include spam filters and AI-enabled video games, provided the systems do not fall within another regulated category.

Article 50 Transparency Requirements Now In Force

Article 50 transparency duties have applied since August 2, 2026, with one limited transition period for machine-readable marking on older generative AI systems. The Commission’s final guidelines now provide practical interpretation of these obligations.

Providers of interactive AI systems must disclose that users are interacting with AI where the artificial nature of the interaction is not obvious.

Providers of covered generative AI systems must mark synthetic audio, image, video, and text outputs in a machine-readable and detectable format under Article 50(2). Exceptions exist for specified assistive editing functions and certain legally authorized uses.

Deployers must disclose deepfakes when Article 50(4) applies. They must disclose covered AI-generated or manipulated public-interest text unless the material has undergone qualifying human review or editorial control and a person or organization holds editorial responsibility.

Deployers of emotion-recognition and biometric-categorization systems must inform exposed individuals where the Article 50 conditions apply.

The machine-readable marking timetable is:

The December 2, 2026 transition applies only to Article 50(2) machine-readable marking for relevant systems already on the market. It is not a general grace period for all Article 50 duties.

The voluntary Code of Practice on Transparency of AI-generated Content provides an EU-wide compliance route for organizations that choose to sign it. About 190 organizations had signed the code before the transparency rules took effect. Code participation does not constitute conclusive proof of legal compliance.

General-Purpose AI Enforcement Now Active

The European Commission can now enforce the AI Act’s general-purpose AI model obligations, including through fines. The underlying GPAI obligations started on August 2, 2025, while the Commission’s full enforcement powers became applicable on August 2, 2026.

Providers of covered GPAI models must:

• Maintain technical documentation.
• Provide required information to downstream AI system providers.
• Maintain a policy for compliance with EU copyright law.
• Publish a sufficiently detailed summary of training content.
• Appoint an authorized representative in the EU when required.

Providers of GPAI models with systemic risk face additional duties covering model evaluations, systemic-risk assessment and mitigation, serious-incident reporting, and cybersecurity protection.

GPAI models placed on the EU market before August 2, 2025, remain subject to a separate transition period ending on August 2, 2027.

The General-Purpose AI Code of Practice remains voluntary. Current signatories include Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI, OpenAI, ServiceNow, and other providers. xAI has signed the Safety and Security chapter only and must demonstrate transparency and copyright compliance through other adequate means.

High-Risk AI Deadlines Moved To 2027 And 2028

The Digital Omnibus moved the principal high-risk AI requirements from 2026 to fixed dates in 2027 and 2028. Regulation (EU) 2026/1744 states that the delayed availability of standards, common specifications, guidance, and national competent authorities created implementation problems under the original timetable.

Stand-alone high-risk systems classified under Article 6(2) and Annex III become subject to the relevant Chapter III requirements on December 2, 2027.

Annex III categories include AI used in areas such as:

• Biometrics
• Critical infrastructure
• Education and vocational training
• Employment and worker management
• Essential private and public services
• Law enforcement
• Migration, asylum, and border control
• Administration of justice and democratic processes

High-risk AI systems classified under Article 6(1) and connected to regulated products in Annex I reach their revised deadline on August 2, 2028. These can include AI safety components used in regulated product categories.

The postponed requirements cover areas such as risk management, data governance, technical documentation, record keeping, human oversight, accuracy, cybersecurity, conformity assessment, and post-market monitoring.

Companies operating systems that may qualify as high-risk still have preparation work to complete. Classification, system inventories, data controls, supplier documentation, and technical testing can begin well ahead of the legal application dates.

EU AI Act Penalties And Fine Levels

EU AI Act fines can reach €35 million or 7% of worldwide annual turnover for prohibited AI practices. Article 99 sets lower maximum tiers for other operator violations and inaccurate information supplied to authorities.

For undertakings, the percentage and fixed-sum rules depend on the relevant penalty provision. SMEs, including startups, receive the lower of the applicable fixed amount or turnover percentage under Article 99. The Digital Omnibus introduces separate treatment for small mid-cap enterprises in specified penalty categories.

National authorities remain responsible for much of the system-level enforcement. The European AI Office directly supervises GPAI providers and holds additional authority in defined cases.

AI Industry Response And Voluntary Codes

Major AI providers have taken different approaches to the EU’s voluntary compliance codes while the binding AI Act requirements continue to apply independently. The GPAI Code of Practice provides one method for model providers to demonstrate compliance with transparency, copyright, safety, and security duties.

Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI, OpenAI, ServiceNow, and several other providers appear on the Commission’s current GPAI Code signatory list. xAI participates only in the Safety and Security chapter.

The separate Code of Practice on Transparency of AI-generated Content received signatures from about 190 organizations before Article 50 became applicable. The Commission and AI Board assessed that code as an adequate voluntary instrument for supporting compliance with covered transparency obligations.

These voluntary codes do not replace the AI Act. Organizations remain responsible for meeting the statutory requirements that apply to their role and systems.

EU AI Act Compliance Steps After August 2, 2026

Companies should now treat applicable August 2026 requirements as current compliance obligations rather than future preparation items. The next immediate date is December 2, 2026, followed by major GPAI and high-risk AI deadlines in 2027 and 2028.

The following steps provide a practical compliance sequence:

1. Create And Maintain An AI Inventory. Record each AI system and model, its owner, provider, intended purpose, users, data flows, output uses, integration points, and geographic reach.
2. Classify Each System And Organizational Role. Determine whether the organization acts as a provider, deployer, importer, distributor, product manufacturer, or another regulated operator. Determine whether each system falls within prohibited, high-risk, transparency, GPAI, or lower-risk categories.
3. Apply Current Article 50 Disclosures. Confirm that covered interactive AI systems disclose AI interaction and that deployers meet applicable disclosure duties for deepfakes, emotion recognition, biometric categorization, and public-interest AI text.
4. Check Machine-Readable Marking. Relevant generative AI systems placed on the market on or after August 2, 2026, should meet the current Article 50(2) requirement. Providers of covered systems already on the market before that date have until December 2, 2026.
5. Prepare For The December 2026 Article 5 Changes. Review product purpose, foreseeable misuse, content controls, safeguards, abuse reporting, and deployment rules connected to the new non-consensual intimate-content and child sexual abuse material provisions.
6. Review GPAI Providers And Models. Obtain relevant documentation covering model capabilities, limitations, copyright policies, training-content summaries, safety measures, and contractual responsibilities.
7. Maintain AI Literacy Measures. Providers and deployers already have an AI literacy obligation under Article 4. Training and awareness measures should reflect staff roles, technical knowledge, experience, and the context in which systems are used.
8. Document Human Oversight. Assign responsible personnel where human review or intervention forms part of the applicable control model.
9. Maintain An AI Incident Process. Document methods for recording, investigating, escalating, and responding to AI failures, harmful outputs, security events, and regulatory complaints.
10. Review Contracts And Vendor Responsibilities. Record who supplies documentation, communicates model changes, responds to incidents, retains evidence, and provides technical access when required.
11. Preserve Compliance Evidence. Keep policies, system records, risk assessments, test results, approvals, logs, training records, supplier documentation, and remediation records.
12. Prepare For The Next Deadlines. Track December 2, 2026, August 2, 2027, December 2, 2027, and August 2, 2028 according to the systems and models within scope.

An ISO/IEC 42001 AI management system can provide a structured method for assigning ownership, documenting AI risks, and maintaining governance records. ISO 42001 AI management system

A formal vendor risk management program can support reviews of third-party model providers, contractual responsibilities, security controls, and material model changes. vendor risk management program

EU AI Act Cybersecurity Requirements And Related EU Rules

Cybersecurity forms part of the EU AI Act’s requirements for high-risk AI systems and GPAI models with systemic risk. Organizations may need to assess AI security alongside other EU regimes that apply to the same systems, products, or businesses.

The European Commission published its Action Plan on Cybersecurity and Artificial Intelligence on July 7, 2026. The plan connects AI security work with the AI Act, NIS2, the Cyber Resilience Act, DORA, and the Cyber Solidarity Act.

The plan covers greater EU capacity for AI model evaluation and testing. The Commission is preparing additional assessment capacity for advanced models and work related to secure AI testing for critical sectors.

Security programs for regulated AI can include access controls, model testing, adversarial testing, vulnerability management, logging, supplier assessments, and incident response where these controls are relevant to the organization’s legal duties and risk profile.

Financial organizations may need to consider the AI Act alongside DORA cybersecurity requirements when AI systems support regulated financial services.

Remaining EU AI Act Implementation Questions After August 2, 2026

The main EU AI Act uncertainty has shifted from the August 2026 deadline to technical implementation and enforcement practice. Article 50 is now applicable, final transparency guidelines are available, and the Digital Omnibus has fixed the revised high-risk dates.

Machine-readable marking remains a technical challenge. Metadata and other provenance signals can be affected through editing, compression, screenshots, or transfers between services. Providers of systems placed on the market before August 2, 2026, have until December 2, 2026, to meet Article 50(2).

The new Article 5 provisions taking effect on December 2, 2026, contain detailed conditions for provider and deployer liability. General-purpose systems are not automatically prohibited simply due to technical capability. The amended text focuses provider restrictions on intended purpose or reasonably foreseeable and reproducible generation where adequate safeguards are absent. Deployers fall within the prohibition when they use the system for the prohibited purpose.

High-risk AI implementation still depends on standards, technical guidance, conformity-assessment processes, and organizational preparation before 2027 and 2028. The Digital Omnibus moved these dates specifically in response to delays in the supporting implementation infrastructure.

Enforcement practice may vary across the 27 EU member states as national authorities apply the rules. The European AI Office coordinates governance and directly handles GPAI enforcement within its statutory authority.

Organizations may face overlapping duties under the GDPR, NIS2, DORA, the Cyber Resilience Act, the Digital Services Act, and national law. AI Act compliance does not replace obligations created under those regimes.

How Bright Defense Helps Companies Prepare For EU AI Act Compliance

Bright Defense supports EU AI Act compliance preparation through Security Assessments, Continuous Compliance, Penetration Testing, risk assessments, and policy work. These services can help organizations document AI systems, examine security controls, test connected applications, and maintain compliance evidence.

Security Assessments can examine AI access, data handling, vendor dependencies, logging, incident processes, and human-oversight controls. Penetration Testing can test applications, APIs, cloud environments, and other technical infrastructure connected to AI services.

Continuous Compliance can help teams track control failures, evidence gaps, and remediation work between formal reviews. Bright Defense services can cover scoping, risk assessments, control design, evidence review, remediation planning, security awareness training, penetration testing, vCISO support, and audit preparation.

Bright Defense does not provide legal opinions on the EU AI Act. Organizations should work with qualified EU legal counsel to determine their regulatory classification, territorial scope, and formal legal obligations.

Sources Cited In This EU AI Act Report

1. European Union: Regulation (EU) 2024/1689, Artificial Intelligence Act, current consolidated framework.
2. European Union: Regulation (EU) 2026/1744, Digital Omnibus on AI, signed July 8, 2026, published July 24, 2026, effective July 27, 2026.
3. European Commission: Commission Starts Enforcing AI Act Rules And New Transparency Requirements On August 2, published July 31, 2026.
4. European Commission: Guidelines On Transparency Obligations For Providers And Deployers Of AI Systems, published July 20, 2026.
5. European Commission: Transparency Obligations Under Article 50 Of The AI Act, current guidance for the August 2 and December 2, 2026 deadlines.
6. European Commission: General-Purpose AI Code Of Practice, current signatory and compliance information, updated July 31, 2026.
7. European Commission: Guidelines For Providers Of General-Purpose AI Models, current GPAI compliance and enforcement timetable.
8. European Commission: Governance And Enforcement Of The AI Act, current enforcement structure.
9. European Commission: Code Of Practice On Transparency Of AI-generated Content, current Article 50 implementation resource.
10. European Commission: EU Action Plan On Cybersecurity And Artificial Intelligence, published July 7, 2026.