Munich: The most consequential date on Europe’s technology calendar this year is the second of August, and the closer it comes the more nervous compliance teams across the continent become. On that day the bulk of the Artificial Intelligence Act becomes enforceable, the rules for high-risk systems take hold, and the Commission’s powers to investigate, demand documents, restrict access to models and levy fines switch on in earnest. After two years of phased deadlines and voluntary preparation, the regulation acquires teeth.
The law has been arriving in instalments since it entered force in the summer of 2024. The first tranche, banning a short list of prohibited practices such as social scoring and certain biometric surveillance, applied from February 2025. Obligations for the developers of general-purpose models followed in August 2025, accompanied by a Code of Practice that roughly two dozen providers have now signed, including the largest American and European labs. What changes this August is not the existence of the obligations but the consequences of ignoring them, as the enforcement machinery built around the new AI Office becomes operational.
For companies that build or merely deploy artificial intelligence, the practical questions are suddenly urgent. A bank using an algorithm to score loan applications, a hospital relying on diagnostic software, a manufacturer automating safety checks, all may find their systems classified as high-risk and subject to demanding requirements on data quality, human oversight, transparency and record-keeping. Many firms are discovering that they do not have a clear inventory of where artificial intelligence sits inside their own operations, let alone documentation that would satisfy a regulator. The compliance burden falls hardest on those who assumed the rules applied only to the technology giants that grab the headlines.
The general-purpose model providers face their own reckoning. Signing the Code of Practice offers a presumption of compliance and a smoother relationship with the AI Office, but it also commits signatories to disclosures about training data, copyright safeguards and systemic-risk testing that some regard as commercially sensitive. A handful of firms have declined to sign, betting that they can demonstrate compliance on their own terms. From August the Commission can test that confidence directly, with the authority to request technical information and, in extreme cases, force a model off the market.
Industry groups have spent the spring lobbying for a softer landing, arguing that overlapping obligations and unfinished technical standards leave businesses unsure how to comply even when they want to. Some have called for the timeline to slip, warning that premature enforcement could push artificial-intelligence development toward jurisdictions with lighter rules. The Commission has so far held the line, insisting that the dates are fixed and that the standards bodies will deliver the guidance firms need. Officials argue that predictability is itself a virtue, and that repeatedly moving the goalposts would reward those who delayed preparing.
What emerges in August will be the world’s most ambitious attempt to govern a fast-moving technology through binding law rather than guidance, and the rest of the world is watching to see whether it constrains innovation or simply channels it. The answer will not be clear on the second of August. The deadline marks the start of enforcement, not the end of the argument, and the first real test will come when the AI Office decides which company to scrutinise first.
