Enforcement and Transparency Obligations Under the EU AI Act are Now in Effect

On August 2, 2026, the EU AI Act (the “AI Act”) entered a new implementation phase with two key developments: (i) the European Commission’s AI Office and Member State authorities began enforcing applicable AI Act requirements, including the rules for general-purpose AI (GPAI) models; and (ii) the AI Act’s Article 50 (transparency obligations) also took effect, requiring certain providers and businesses using AI to disclose when people are interacting with AI. Although the AI Act entered into force over two years ago, August 2026 marks a new chapter in its implementation. Businesses should expect increased regulatory oversight and scrutiny of AI developed, offered, or used in the EU.

AI System, Defined

The AI Act regulates “AI Systems” which is broadly defined as any “machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.”

Regulated Entities Under the AI Act

Entities. The AI Act applies to a variety of entities, including those that provide, deploy, import, distribute, and manufacture AI Systems. For most businesses, the most relevant classifications will be providers and deployers:

• Providers of AI Systems are those entities that develop AI Systems and place them on the market, such as OpenAI or Anthropic.

• Deployers use AI Systems under their authority in connection with their business or professional activities. For example, a company that implements an enterprise AI tool for employee, customer service, recruiting, or other business use may be a deployer.

Scope. Like the GDPR, the AI Act can apply beyond the EU’s borders. Its territorial scope may extend to organizations outside the EU that place AI Systems or general-purpose AI models on the EU market, put them into service in the EU, or deploy AI Systems whose output is used in the EU. In practical terms, businesses do not need to be established in the EU to be subject to the AI Act.

Enforcement and Penalties

Article 99 of the AI Act applies a tiered penalty approach.

• Prohibited Practices. Engaging in prohibited practices under the AI Act’s Article 5 can result in penalties up to €35 million or 7% of total worldwide annual turnover in the preceding financial year, whichever is higher.

• Violations of General and High-Risk AI Obligations. Penalties related to general and high-risk obligations, including those outlined in Article 50, can result in penalties up to €15 million or 3% of total worldwide annual turnover in the preceding financial year, whichever is higher.

• Misleading Information. The supply of incorrect, incomplete or misleading information to EU regulators in reply to a request for information can result in penalties up to €7.5 million or 1% of total worldwide annual turnover in the preceding financial year, whichever is higher.

Additionally, where an AI-related practice also violates the EU comprehensive data privacy law, the GDPR, regulators may separately enforce the GDPR, which provides for significant fines.

Transparency Obligations

Article 50 of the AI Act imposes transparency requirements on certain providers and deployers of AI Systems to help individuals in the EU understand when and how AI is being used. Although the specific obligations vary by role and use case, they generally address chatbots and other systems that interact directly with individuals. In many cases, organizations must inform users when they are interacting with AI rather than a human. These measures are intended to promote transparency and help individuals make informed decisions when interacting with AI Systems.

Providers must:

• Design AI Systems in a way that ensures individuals are explicitly informed whenever they interact with an AI System directly; and
• Add machine-readable marks to enable the detection of AI-generated or manipulated content.

Deployers of AI Systems must inform individuals when they are exposed to:

• Emotion recognition and biometric categorization tools;
• Deepfakes; and
• Text publications on matters of public interest without human review or editorial control.

Business Considerations

Businesses operating, offering an AI System in, or deploying AI whose outputs are used in the EU should consider the following practical steps:

• Identify AI Systems In Use. Develop an AI inventory outlining AI Systems and features used across the business, including standalone generative-AI tools and AI functionality embedded in SaaS products. This inventory should document each AI System’s purpose, business owner, users, whether it is internal or customer-facing, and where it is used or made available, including the EU.

• Adopt an AI Governance Policy. Establish clear rules for approved and prohibited AI uses, data-handling restrictions, human oversight requirements, and security controls. Communicate the policy and provide training to employees who use AI Systems.

• Create an AI Governance Committee. Designate a cross-functional group, such as legal, privacy, security, compliance, IT, and business stakeholders to assess new AI use cases, assign risk levels, and approve appropriate controls before broader deployment.

• Review AI-provider Agreements. Carefully review agreements with AI providers to confirm how the provider allocates compliance responsibilities, supports required disclosures and documentation, manages security and incident notifications, and permits the business to meet its own obligations under applicable law.

• Enable Required Consumer Disclosures. For customer-facing AI Systems, assess whether users must be informed that they are interacting with AI. Article 50 generally requires notice no later than the first interaction, unless the AI nature of the interaction is obvious in context; additional disclosure rules can apply to deepfakes, certain AI-generated public-interest content, emotion-recognition systems, and biometric-categorization systems.

Looking Ahead

More sections of the AI Act will take effect in the months to come. The AI Omnibus has set the following compliance periods for the next 24 months:

• December 2, 2026 – new prohibitions will be introduced by the AI Omnibus regarding AI Systems that generate non-consensual sexually explicit content and child abuse material.
• December 2, 2027 – the new date established by the AI Omnibus regarding the application of rules governing high-risk AI Systems.
• August 2, 2028 – new date established by the AI Omnibus regarding rules for high-risk AI Systems integrated into regulated products.

Taft will continue to monitor the EU AI Act’s implementation for updates and new developments. If you have questions about this regulation, or about EU privacy laws more broadly, Taft’s Privacy, Security & AI attorneys are available to assist. As always, please sign up to receive emails of our latest posts here on Privacy and Data Security Insights, and follow us on LinkedIn for the latest in privacy, security and artificial intelligence legal news.