Sixteen days from now, the EU AI Act becomes fully applicable across all 27 member states, and the parts that activate on 2 August 2026 are precisely the parts industry lobbyists failed to defer. The Commission’s penalty powers over general-purpose AI providers switch on, Article 50 transparency obligations land on schedule, and full market surveillance goes live. The maximum GPAI fine: €35M or 7% of worldwide turnover.

What didn’t survive the summer is the high-risk tier. The Digital Omnibus, endorsed by the European Parliament on 16 June and adopted by the Council on 29 June, pushed stand-alone Annex III obligations to 2 December 2027 and Annex I embedded systems to 2 August 2028. Publication in the Official Journal is expected before the deadline itself.

Read structurally, the Omnibus is a familiar Brussels pattern: preserve the headline architecture, slip the operational deadlines. GDPR’s 2018 rollout followed the same logic, and enforcement there didn’t get serious until years after the calendar said it should. SME simplifications now extend up to mid-caps of 750 employees and €150M revenue, another concession to the compliance-cost argument.

The immediate obligations aren’t symbolic. Latham & Watkins notes that Article 50 requires deployers to tell users when they’re interacting with an AI system. Generative models placed on the market before 2 August get a watermarking grace period until 2 December 2026, the same date a new Article 5 prohibition on AI-generated non-consensual intimate imagery and CSAM takes effect. GPAI substantive rules have applied since August 2025; only now do fines follow. National sandbox deadlines have slipped to 2 August 2027.

The Commission published its Code of Practice on transparency on 9 July. The AI Office’s first GPAI enforcement action is the number to watch.

Sources

Sources