Brussels: With less than three months to go before the European Union’s flagship Artificial Intelligence Act enters its most consequential enforcement phase, the regulatory landscape across the bloc remains uneven and the political battle over its scope is intensifying. From 2 August 2026, the main high-risk AI compliance framework activates, alongside Article 50 transparency requirements for AI-generated content and full enforcement powers at both national and EU level.
The penalty architecture is heavy by design. Breaches involving high-risk systems can attract fines of up to fifteen million euro or three percent of global annual turnover, while violations of the prohibited-practice provisions, already in force since February 2025, can climb to thirty-five million euro or seven percent of turnover. The European AI Office, embedded within the Commission, holds exclusive enforcement powers over general-purpose AI models, while national competent authorities are responsible for market surveillance of high-risk systems deployed on their territory.
Implementation is uneven. Finland became the first member state to activate its national supervision laws on 1 January 2026, setting a precedent that other capitals are expected to follow through the first half of the year. National regulatory sandboxes, mandated under Article 57, are being established to allow companies to test novel systems under supervision before full market launch. Yet several member states are still finalising the designation of notifying authorities and market surveillance bodies.
The November 2025 Digital Omnibus proposal has added a layer of uncertainty. Tabled by the Commission as part of a broader simplification drive, it would delay certain high-risk obligations and shift the hard backstop for standalone Annex III systems to December 2027, with embedded AI systems under regulated Annex I products pushed to August 2028. The proposal has not yet been enacted, and industry counsel widely advises clients to continue planning to the statutory August 2026 deadline and treat any postponement as scheduling relief rather than a license to slow preparations.
For general-purpose AI model providers, the obligations under Chapter V have applied since 2 August 2025. The Commission’s enforcement powers, including the authority to request documentation, conduct evaluations and impose risk-mitigation measures, come into force on the same August 2026 date. Models placed on the market before August 2025 have until August 2027 to come into compliance. The European AI Office’s Code of Practice for general-purpose models has become the de facto compliance pathway, with major foundation-model developers signing on through 2025 and 2026.
The political stakes extend well beyond legal compliance. The Commission has positioned the AI Act as the foundation of a European approach that pairs innovation with rights protection, in deliberate contrast to the largely permissive regulatory environments in the United States and parts of Asia. Industry groups argue that the layered structure, with its conformity assessments, technical documentation, logging and human-oversight requirements, risks slowing European deployment of frontier systems. Civil society organisations counter that without strict enforcement, the law’s protective provisions will be hollowed out.
The June 2026 publication of the final Code of Practice on marking and labelling AI-generated content is the next milestone observers are tracking. So is the Commission’s first mandatory review of Article 5 prohibitions, conducted in February 2026, which may expand the list of banned applications to cover emerging concerns in predictive policing, educational assessment and workplace surveillance.
Whether the August enforcement date holds or slips, the trajectory is clear. Europe has moved from setting rules on paper to building the institutional and technical capacity to apply them. The next test is whether that capacity scales fast enough to keep pace with the technology itself.
