EU moves to implement AI Act
The European Union is transitioning from writing AI rules to putting them into practice, with implementation work on the AI Act and consultations closing on procedural rules for model access and safeguards. That shift signals tightening obligations for providers of general‑purpose AI models and a move toward enforcement mechanics rather than abstract standards. For companies operating in Europe, the compliance bar is becoming clearer—and potentially more costly to meet. (dig.watch, dig.watch)
Europe spent 2024 writing its artificial intelligence law. In April 2026, it is working out how officials will actually inspect models, demand access, and run cases that could end in fines. (dig.watch, eur-lex.europa.eu) The immediate trigger is a European Commission consultation that closed on April 8, 2026, on draft procedure rules under the Artificial Intelligence Act. Those draft rules cover how Brussels can evaluate general-purpose artificial intelligence models and what safeguards apply if it opens enforcement proceedings. (dig.watch) General-purpose artificial intelligence models are the base models underneath chatbots, coding assistants, and image generators. The European Union’s own guidance says these providers must prepare technical documentation, set a copyright policy, and publish a summary of training content. (digital-strategy.ec.europa.eu, digital-strategy.ec.europa.eu) For the most powerful models, the rulebook gets heavier. The Commission says models that pose “systemic risk” must be notified to the European Union, evaluated for risk, protected with cybersecurity measures, and reported when serious incidents happen. (digital-strategy.ec.europa.eu, digital-strategy.ec.europa.eu) This is not a brand-new deadline appearing out of nowhere. The Commission says the obligations for providers of general-purpose models started applying on August 2, 2025, while its enforcement powers over those providers start applying on August 2, 2026. (digital-strategy.ec.europa.eu) That one-year gap is why the current paperwork matters. Europe already told companies what the duties are in guidelines published on July 18, 2025, and in a voluntary code of practice published on July 10, 2025; now it is filling in the mechanics for inspections and cases. (digital-strategy.ec.europa.eu, digital-strategy.ec.europa.eu) The draft procedure text is unusually concrete about access. It says a Commission order for model access can specify application programming interfaces, source code, model weights, hosting infrastructure, and even the same access levels the provider gives its own employees. (dig.watch) It also says the Commission could require a provider to disable logging that tracks the Commission’s access if that is needed to protect the integrity and confidentiality of an evaluation. In the same draft, companies facing preliminary findings would get at least 14 days to submit written observations, with some file access but with business secrets redacted. (dig.watch) The law behind this was adopted as Regulation (European Union) 2024/1689 and published in the Official Journal on July 12, 2024. Its core design is a single market rulebook, so Paris, Berlin, and Rome do not each create different artificial intelligence compliance systems for the same model. (eur-lex.europa.eu) There is one important carveout companies keep watching. The Commission’s guidance says some free and open-source model providers can be exempt from certain obligations, and it says only actors making significant modifications to a model, not minor tweaks, are treated as providers for these duties. (digital-strategy.ec.europa.eu) So the shift in April 2026 is simple: Europe is moving from “here are the rules” to “here is how we enter your system, review your model, hear your defense, and, if needed, stop distribution on urgency grounds.” That is the point where compliance stops being a policy debate and starts looking like an audit. (dig.watch, digital-strategy.ec.europa.eu)
