EU AI Act enforcement ramps

On August 2, 2026, the European Union’s main Artificial Intelligence Act rules for high-risk systems start applying, after the law entered into force on August 1, 2024 and phased in earlier bans on some practices on February 2, 2025. (digital-strategy.ec.europa.eu) That turns a long policy rollout into a compliance deadline for companies selling or using artificial intelligence in Europe, because the law covers providers, deployers, importers, and distributors in the European Union market. (eur-lex.europa.eu) The law works like airport security, not a blanket ban: most systems face light rules, but “high-risk” systems get the full inspection. The European Commission says those high-risk categories include areas like employment, education, essential services, law enforcement, and migration. (digital-strategy.ec.europa.eu) A hiring model that screens job applicants can land in that high-risk bucket, and so can software used in schools or critical infrastructure. Once a system is in that bucket, the provider has to build a risk-management system, keep logs, write technical documentation, and set up post-market monitoring. (eur-lex.europa.eu) That paperwork is not side paperwork. The Artificial Intelligence Act says providers of general-purpose models must produce technical documentation, give downstream developers enough information to integrate the model safely, and publish a sufficiently detailed summary of the content used for training. (digital-strategy.ec.europa.eu) Those general-purpose model duties already started on August 2, 2025, which means the summer of 2026 is not one cliff but a second one. Companies that shipped a model last year now have to show how that model behaves when it is embedded inside a regulated product or service. (digital-strategy.ec.europa.eu) The pressure is especially high for so-called agentic systems, which are built to take a goal like “book the trip” or “resolve the claim” and then choose multiple steps on their own. The law does not use the word “agentic” as a special category, but that behavior can push a system into higher-risk territory because it changes how much autonomy, monitoring, and traceability a company needs. (digital-strategy.ec.europa.eu) Europe is also building a playbook for the biggest foundation models. The General-Purpose Artificial Intelligence Code of Practice was published on July 10, 2025 as a voluntary tool to help providers comply with the law’s model obligations, and its safety and security chapter is aimed at the small set of models with “systemic risk.” (digital-strategy.ec.europa.eu) “Systemic risk” means the model is powerful enough that a failure could spread across many products and users, the way a flaw in a cloud platform can ripple through thousands of apps. For those models, the code points to model evaluations, adversarial testing, serious-incident reporting, and cybersecurity protections. (digital-strategy.ec.europa.eu) The enforcement teeth are large enough to get board attention. The European Commission says the Artificial Intelligence Act allows fines of up to 35 million euros or 7 percent of global annual turnover for some violations, with lower maximum bands for other breaches and for giving wrong information to authorities. (digital-strategy.ec.europa.eu) So the scramble now is less about building a smarter chatbot and more about building a paper trail: what data went in, what the model can do, where humans can stop it, what gets logged, and who is responsible after launch. Europe wrote the rulebook in 2024, started parts of it in 2025, and on August 2, 2026 it starts checking whether companies actually kept the receipts. (digital-strategy.ec.europa.eu)