EU pushes AI Act enforcement

The European Union’s AI Act has moved from political agreement into a staged compliance regime with deadlines that are already binding on companies selling or deploying AI in Europe. The law entered into force on August 1, 2024, and the first obligations — including bans on certain AI practices and AI literacy duties — started applying on February 2, 2025, according to the European Commission. Rules for providers of general-purpose AI models followed on August 2, 2025. The broadest set of obligations will apply from August 2, 2026. ### Which parts of the AI Act are already being enforced? February 2, 2025 was the first operational deadline under the law. From that date, the AI Act’s prohibitions and AI literacy obligations began to apply, the Commission says. The banned practices include several uses the EU classifies as “unacceptable risk,” such as certain manipulative systems, social scoring, some biometric categorisation uses, and untargeted scraping of facial images to build recognition databases. (commission.europa.eu) August 2, 2025 added a second compliance layer for providers of general-purpose AI models. Those obligations apply to foundation-model providers whose systems can be integrated into downstream products, with extra duties for models deemed to carry systemic risk, according to Commission guidance. ### Who is policing this now? (digital-strategy.ec.europa.eu) The European Commission has split oversight between Brussels and national authorities. The AI Office supervises and enforces the rules for general-purpose AI models, while national market surveillance authorities in member states are responsible for implementing, supervising and enforcing the rules for AI systems, including prohibited practices and high-risk systems. (digital-strategy.ec.europa.eu) Each member state must appoint one or more market surveillance authorities, and those bodies have investigative and enforcement powers under the EU’s market-surveillance framework. The AI Act Service Desk says those authorities can demand documentation and, in some cases, access technical information needed to check compliance. (digital-strategy.ec.europa.eu) ### Why are companies changing product rollouts before August 2026? August 2, 2026 is the date when most of the AI Act becomes applicable. That includes the main rules for high-risk AI systems listed in Annex III, transparency obligations under Article 50, innovation measures and the start of broader national and EU-level enforcement, according to the Commission’s implementation timeline. (digital-strategy.ec.europa.eu) The result is that companies have had to map products against the law’s risk categories well before that date. The Commission describes the framework as risk-based, with different obligations depending on whether a system is prohibited, high-risk, subject to transparency rules, or considered limited or minimal risk. ### What does “risk-based” mean in practice? (digital-strategy.ec.europa.eu) The Commission says the AI Act sorts AI systems into four broad levels of risk. At the top are prohibited uses. Below that are high-risk systems, which face compliance requirements tied to safety, documentation, monitoring and governance. Separate transparency rules apply to certain systems, including some AI systems that interact with people or generate synthetic content. (digital-strategy.ec.europa.eu) For companies, that means the same model can trigger different obligations depending on how and where it is deployed. A general-purpose model provider may face one set of duties from August 2025, while a company embedding AI into a high-risk use case may face another set from August 2026. That sequencing is set out in the Commission’s timeline and guidance. (digital-strategy.ec.europa.eu) ### Where could enforcement become uneven? National enforcement capacity is one pressure point. Member states must designate national competent authorities and adopt national laws on penalties as part of the implementation process, according to the AI Act timeline maintained by the EU service desk. A separate overview of national implementation plans says those authorities must have adequate technical, financial and human resources to carry out their tasks. (digital-strategy.ec.europa.eu) That leaves the next test in the hands of both Brussels and national capitals. On August 2, 2026, the majority of the AI Act’s rules begin to apply, and member states are also expected to have governance structures, including at least one AI regulatory sandbox per country, in place under the implementation schedule. (ai-act-service-desk.ec.europa.eu) (artificialintelligenceact.eu)