EU AI Act 2026: What Applies in August, What Waits

EU AI Act effective date: what applies on 2 August 2026

The EU AI Act started to apply on 2 August 2026, though the European Commission says this comes with "some exceptions". The law entered into force on 1 August 2024, but that step did not switch on every rule: each set of duties has its own application date. Those dates decide which duties can still wait.

The EU AI Act timeline leading to August 2026

Duties phase in between February 2025 and August 2028, with the general date of 2 August 2026 in the middle. The Act groups AI systems into four risk levels: unacceptable risk (banned), high risk, transparency risk, and minimal or no risk. Here are the dates in order.

The later dates come from the "AI Omnibus", a simplification package. The Commission proposed it on 19 November 2025, political agreement was reached on 7 May 2026, and it entered into force on 27 July 2026, six days before the general date. For the background, see EU AI Act Omnibus: New Deadlines and Nudifier Ban.

A summary of what switches on and what stays off

As of 2 August 2026, the duties split into three groups: starting now, still pending, and already in force. The first group needs work now, and the third is now open to enforcement.

• Starting now, from 2 August 2026: the Article 50 duties to disclose AI interaction and deepfakes, marking of AI output for systems placed on the market from that date, and enforcement by the AI Office and the Member State authorities.
• Still waiting: marking for generative systems already on the market (until 2 December 2026), the ninth prohibition (2 December 2026), Annex III high-risk rules (2 December 2027) and Annex I high-risk rules (2 August 2028).
• Already applying before August: the first eight prohibitions, AI literacy, and the GPAI obligations. The 2026 change for these is that the AI Office and Member State authorities can now enforce them.

What is delayed: high-risk rules and watermarking

Three parts of the Act did not take effect on 2 August 2026: the high-risk rules, marking for generative systems already on the market, and the ninth prohibition. Spotting them early avoids wasted work, since none of the three needs action by the general date.

EU AI Act high-risk rules move to 2027 and 2028

The rules for standalone high-risk AI (Annex III) now apply from 2 December 2027, and those for high-risk AI built into regulated products (Annex I) from 2 August 2028. The Act treats as high-risk the AI uses that can seriously threaten health, safety or fundamental rights.

Annex III lists standalone uses, and the Commission's examples include biometrics, critical infrastructure, education, employment, migration, asylum and border control. Annex I deals with AI inside products that already have their own safety rules, such as lifts or toys.

Only the dates moved; the high-risk rules themselves stay in the Act. The Commission's stated reason is timing, so that the rules apply once companies have support tools such as standards.

Watermarking deadline for older systems is 2 December 2026

Article 50(2) marking, often called watermarking, has a transition period: providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026. The implementation timeline gives this transition to providers of systems that generate synthetic content, including general-purpose systems. No other Article 50 duty is on that list of delays, so the chatbot and deepfake disclosure duties apply from the general date.

What decides it in practice is the date a system was placed on the market. As the timeline is worded, systems not on the market before 2 August 2026 do not get the transition, so confirm that date before counting on the extra months.

The prohibited practices list grows in December 2026

From 2 December 2026, the ninth prohibition bans AI that generates non-consensual sexual or intimate content and child sexual abuse material. The Act prohibits nine practices outright, and the first eight, social scoring among them, have applied since February 2025. The Omnibus added the ninth, aimed at systems such as "nudification" apps.

EU AI Act Article 50: the transparency duties now in force

Article 50 took effect on 2 August 2026, with a single transition, and it requires you to make clear when something is AI. It does not demand the heavy documentation required for high-risk AI. The duties are split between two roles.

A provider is anyone who develops an AI system, or has one developed, and places it on the market under its own name. A deployer is anyone who uses an AI system under its own authority, and the same business can be both.

Chatbots must tell people they are talking to AI

Article 50(1) requires a chatbot to be designed so that its users are informed they are dealing with an AI system. The Commission names chatbots, AI agents and avatars as examples. Two exceptions apply.

The first applies when this is obvious to a reasonably well-informed, observant and circumspect person, given the circumstances and context of use. The second covers systems authorized by law to detect, prevent, investigate or prosecute criminal offenses, but not systems open to the public for reporting a crime. Ordinary businesses will mostly deal with the first, and "obvious" is judged from that reasonably well-informed person's view, not the provider's.

The timing is set too. Under paragraph 5, the information required by paragraphs 1 to 4 must be clear and distinguishable and must be given no later than the first interaction or exposure. A notice that only shows up once the conversation is underway is too late.

Deepfakes and AI-generated content need disclosure

Generated content is covered twice: providers mark it in machine-readable form, and deployers disclose deepfakes. Article 50(2) requires providers of systems that generate synthetic audio, images, video or text, including general-purpose systems, to make outputs detectable as artificially generated or manipulated in a form software can read. The transition for systems already on the market covers paragraph 2 only.

Under Article 50(4), a deployer that generates or manipulates a deepfake must disclose that the content is artificial. The Commission's summary adds text published to inform the public on matters of public interest when no human review or editorial control took place. For emotion recognition and biometric categorization, Article 50(3) requires the deployer to inform the people exposed to the system.

The code of practice on marking and labeling

Signing the Code of Practice on Marking and Labelling of AI-generated Content is voluntary. It gives providers and deployers of generative AI a set of icons that can be used to show that images, audio or text are artificial.

The Guidelines on transparency obligations cover scope, definitions, the duties and the exceptions, and the Commission says following a code of practice can demonstrate compliance. Together, the two documents set out what the Commission expects.

EU AI Act enforcement and fines from August 2026

Since 2 August 2026, the AI Office and national authorities have been able to supervise the Act and fine companies that break it. General-purpose AI (GPAI) models can handle a wide range of tasks and sit underneath many AI systems used in the EU. Their providers have been bound by rules since 2 August 2025, and the general date lets the authorities act on those rules.

How the AI Office enforces rules on GPAI models

Over GPAI models, the AI Office has the enforcement powers: it can ask for technical documentation, evaluate models, order corrective measures and impose fines. Since 2 August 2026, implementing, supervising and enforcing the Act has been shared between the AI Office and the Member State authorities. The Omnibus aims to give the AI Office a bigger role still: it would centralize oversight of AI systems built on GPAI models to cut fragmentation.

More bodies enforce the Article 50 duties. National market surveillance authorities, the AI Office for systems it supervises, and the European Data Protection Supervisor (where EU institutions are providers or deployers) enforce the transparency rules and can impose fines.

For companies, the Commission's news item puts fines at up to EUR 15 million or 3% of global annual turnover. That item does not say which figure applies when the two differ, and it notes that proportionality is considered for small and medium-sized enterprises and small mid-cap companies.

The capacity to evaluate models is still growing. According to a July 2026 action plan on cybersecurity and AI, the Commission will open a call to expand the EU's capacity to evaluate AI models before they reach the market, with operation expected by 2027.

EU AI Act fines for GPAI providers: EUR 15 million or 3%

GPAI model providers face a fine capped at 3% of annual total worldwide turnover in the preceding financial year or EUR 15 million, whichever is higher. The cap is in Article 101, and the Commission is the body that imposes it. It applies to intentional or negligent conduct of four kinds: an infringement of the Act, or one of three failures to cooperate:

• not answering a request for documents or information (Article 91), or giving incorrect, incomplete or misleading information
• not complying with a measure the Commission requested (Article 93)
• not giving the Commission access to the model for an evaluation (Article 92)

Fines do not come without notice. Before deciding, the Commission has to share its preliminary findings and let the provider be heard, and the Court of Justice of the European Union has unlimited jurisdiction to review the decision and can cancel, reduce or raise the fine.

Who the EU AI Act covers outside the EU

For a business based outside the EU, the AI Act depends on what happens inside the Union rather than on where you are: where you place a system or model on the market, or where your AI's output is used. The first question, then, is whether the Act applies to you at all.

Scope under Article 2: when output is used in the Union

Article 2(1)(c) covers providers and deployers in a third country (outside the EU) when the output of their AI system is used in the Union. Article 2(1) defines the scope in seven points, two of which matter for a business abroad. Point (a) covers providers that place AI systems or general-purpose AI models on the EU market, whether they are established in the Union or in a third country.

A provider selling a GPAI model to EU customers is covered by (a), while a provider or deployer outside the EU whose system's output is used in the Union may be covered by (c). The wording decides it, so check the provision against your own situation.

Three compliance checks to run now

The EU AI Act checklist for 2026 is short, since the heavy high-risk rules do not apply until 2027 and 2028. Three checks cover the duties that are already live:

• Chatbots reaching people in the EU. Is it clear at the first interaction that an AI is responding?
• Generated content going to the EU. If you provide a generative system, was it placed on the market before 2 August 2026? That decides whether the 2 December 2026 transition for marking is available. If you publish deepfakes or unreviewed AI text on public-interest matters, disclosure is your duty.
• General-purpose models you build on. Ask the provider how it meets the obligations for GPAI providers, since your service runs on its model.