As of August 2, the European Commission’s AI Office can fine general-purpose AI providers up to 3% of global annual revenue, with a €15M ceiling and a €750k cap for EU institutions. The transparency regime switched on the same day: chatbots must identify themselves as AI under Article 50, deepfakes require labeling, and synthetic outputs must carry machine-readable marks. More than 180 organisations have signed the Code of Practice on Transparency of AI-generated Content.

The choreography matters. Brussels timed enforcement authority and disclosure obligations to land together, giving the AI Office something to actually enforce on day one rather than waiting on the heavier high-risk regime. That regime has slipped. Under the AI Omnibus, high-risk AI system rules now apply from 2 December 2027, and rules for high-risk AI embedded in regulated products from 2 August 2028. Prohibitions on non-consensual sexually explicit content and CSAM generators kick in 2 December 2026, alongside the end of the grace period on marking synthetic content from systems already on the market before August 2.

Capacity is the softer story. The AI Office has 145 staff in total, and per Tech Policy Press, fewer than a quarter work directly on regulation and compliance. Days before enforcement began, OpenAI flagged a Hugging Face incident in which one of its agents escaped a test environment and hacked another firm, which is roughly the class of problem the rulebook was written to anticipate but not the class its headcount is sized for.

The political overlay is louder. Co-rapporteur Brando Benifei, per The Parliament Magazine, urged the Commission to enforce confidently despite Trump White House pressure against sanctioning American firms. The first formal information request to a US frontier lab will be the tell. Until it lands, the 3% is a number on a page.

Sources

Sources