EU AI Act August 2026: What Actually Applies Right Now

EU AI Act August 2026: The Transparency and GPAI Phase Is Now Live

As of August 2, 2026, the EU AI Act enters its next major enforcement phase. This is not the full Act — the high-risk provisions are delayed — but it is significant: transparency obligations for AI-facing users and obligations for General Purpose AI (GPAI) model providers are now legally in force.

Here is exactly what applies today and what is still coming.

---

What Is In Force from August 2, 2026

1. Transparency Obligations — All AI Systems

Any AI system that directly interacts with or produces content for EU users must comply with new transparency requirements:

Chatbots and conversational AI: Operators of chatbot systems must "ensure that users are informed they are interacting with an AI system, unless this is obvious from the context." This applies to customer service bots, sales assistants, AI companions, and any other conversational interface.

AI-generated synthetic media: Content that is AI-generated and depicts real or realistic-seeming people, events, places, or text must be "clearly labeled as artificially generated or manipulated." This covers deepfakes, AI-generated video, AI-written news articles presented as factual, and AI voice cloning used in public communications.

Emotion recognition systems: Systems that infer emotional states from biometric data (facial expressions, voice, body language) must notify the people being analyzed.

2. General Purpose AI (GPAI) Model Obligations

GPAI models — the large foundation models that power applications (think: GPT-4.1, Claude, Gemini, Llama) — now have mandatory obligations:

For all GPAI models:

• Publish and maintain technical documentation
• Comply with EU copyright law and maintain a policy for doing so
• Publish sufficiently detailed summaries of training data

For GPAI models with "systemic risk" (very high-capability models, roughly those trained with more than 10^25 FLOPs):

• Conduct and document adversarial testing (red-teaming)
• Report serious incidents to EU authorities
• Implement cybersecurity measures
• Notify the European AI Office about changes that could affect systemic risk classification

Major AI providers (OpenAI, Anthropic, Google, Meta) have been preparing GPAI compliance documentation ahead of this deadline.

---

What Is NOT Yet in Force: High-Risk AI Provisions

A critical clarification: the full high-risk AI obligations that got the most attention during the Act's passage — mandatory risk management systems, human oversight requirements, EU database registration — are delayed.

According to the latest timeline published in July 2026:

• High-risk AI in general applications: Delayed to August 2, 2027
• High-risk AI integrated into regulated products (medical devices, aviation, automotive): Delayed to August 2, 2028

This delay gives organizations building in healthcare, employment, credit, and education AI more time to prepare for the compliance burden — but the delay is not indefinite.

---

What Was Already in Force (Since February 2025)

Prohibited AI practices have been banned since February 2, 2025:

• Social scoring systems that classify people based on personal characteristics or behavior
• Real-time remote biometric identification in public spaces (with narrow law enforcement exceptions)
• AI that manipulates people via subliminal techniques or by exploiting vulnerabilities
• Predictive policing based purely on profiling
• Facial recognition databases built by scraping the internet or CCTV footage

These prohibitions remain in full force.

---

Who Does This Apply To?

The EU AI Act applies to:

Providers (developers and companies that create AI systems) if:

• Their system is placed on the EU market, OR
• The output of their system is used in the EU

Deployers (businesses that use AI systems in their products/services) if:

• They operate in the EU, OR
• Their users are EU-based

This means US, UK, Asian, and all other non-EU companies are subject to the Act if their products reach EU users — similar to how GDPR applies globally.

---

Practical Steps for August 2026 Compliance

If you operate a chatbot or AI assistant:

• Add a clear AI disclosure to your interface — "You are chatting with an AI assistant"
• Ensure this disclosure appears at the start of every new conversation

If you generate AI content (images, video, text):

• Implement content labeling for AI-generated material
• This applies to marketing content, social media posts, and any content that could be mistaken for human-created

If you are a GPAI provider or building on GPAI:

• Ensure your AI provider has published technical documentation as required
• Review your own training data practices if you fine-tune or train models
• If your model reaches systemic risk thresholds, register with the European AI Office

If you operate high-risk AI (HR tools, credit scoring, education AI, healthcare AI):

• You have until August 2027 — but do not wait. Building audit trails, human oversight mechanisms, and risk documentation takes time

---

Enforcement and Penalties

The European AI Office, established as the Act's primary enforcement body, can impose fines of:

• Up to €35 million or 7% of global annual turnover (whichever is higher) for GPAI violations or prohibited AI
• Up to €15 million or 3% of turnover for other violations
• Up to €7.5 million or 1.5% of turnover for providing incorrect information

Early enforcement focus is expected to be on the largest, most visible GPAI providers — not startups. But the legal obligations apply to all covered entities from August 2, 2026.