EU AI Act: Generative AI Has Entered the Real-Obligations Phase

For two years, the EU AI Act felt more like a date on a legal calendar than a change felt by people using AI every day. In August 2026, that phase ended. The European Commission announced that, from August 2, the AI Office and national authorities began enforcing new transparency rules and supervising obligations tied to general-purpose AI models, known as GPAI.

The point is not that every chatbot became illegal or that every AI-made image now needs a giant label. The point is more practical: Europe has moved from principles to documentation requests, model evaluations, possible corrective measures, and fines. For teams integrating AI into products, support, marketing, moderation, or internal tools, the question has shifted from "when is regulation coming?" to "where are our records?".

Timeline

1. August 1, 2024: the AI Act enters into force as the first broad legal framework for artificial intelligence.
2. February 2, 2025: prohibitions begin applying to unacceptable-risk practices such as harmful manipulation, social scoring, and certain biometric uses.
3. August 2, 2025: core obligations for GPAI model providers become applicable, including documentation, information for downstream integrators, and copyright policies.
4. July 20, 2026: the Commission publishes guidance on transparency for providers and deployers of AI systems.
5. August 2, 2026: the AI Office gains GPAI enforcement powers and transparency rules become enforceable.
6. August 10, 2026: Implementing Regulation (EU) 2026/1755 enters into force, detailing Commission procedures, including interim measures and limitation periods for fines.

The official European Commission overview divides the law by risk level. The part that now reaches many organizations is transparency: when someone speaks with an AI system, they generally need to know they are not speaking with a person. Deepfakes and certain AI-generated or AI-altered content must also be labelled, and providers of generative systems must prepare machine-readable marks to support detection.

Taft analysis highlights the practical consequence for businesses: build an AI-system inventory, identify who is a provider and who is a professional deployer, review vendor contracts, and enable consumer notices. It sounds bureaucratic, but it is the difference between saying "we use AI in a few places" and knowing exactly where a person may be led to believe they are interacting with a human, authentic content, or a non-automated decision.

The GPAI layer is even more sensitive. According to Taylor Wessing, since August the AI Office can request technical documentation, require API or source-code access for model evaluations, impose binding commitments, and, in serious cases, restrict or withdraw a model from the European market. Fines can reach 15 million euros or 3% of worldwide annual turnover, whichever is higher, for certain intentional or negligent infringements.

The important detail for startups and technical communities is the role each organization occupies. A team that simply uses a third-party API may be a deployer. A team that integrates an interface, substantially customizes a model, trains its own version, or makes a broad model available under its own brand can move closer to provider obligations. And being outside the EU does not automatically mean being outside scope: if the model is placed on the Union market, the law may require an authorized representative and documentary cooperation.

This is also a less glamorous, but more mature, moment for generative AI. In recent years, the conversation was dominated by benchmarks, context windows, and demos that looked like magic. Now terms such as logs, notices, provenance, contracts, audits, and incidents move to the center. They are not enemies of innovation; they are what lets models enter real services without turning every interface into an invisible social experiment.

For online communities, smaller websites, and teams that use AI for support, moderation, or content creation, the practical lesson is simple: document before improvising. Say when a bot is a bot, review which content needs a label, keep vendor decisions, and separate internal experiments from public features. European law will still have grey areas and plenty of debate, but August 2026 marks a clear turn: AI no longer lives only in launch excitement. It now also lives in the compliance file.