EU AI Act Takes Effect Aug. 2: Compliance

EU AI Act Takes Effect Aug. 2: The Global Compliance Split

The EU AI Act's main rules apply on 2 August 2026 with €35m fines, but Brussels just delayed its hardest obligations by up to two years — reshaping global AI compliance.

The European Union's Artificial Intelligence Act begins general application on 2 August 2026 with penalties of up to €35 million or 7% of global turnover, yet the Digital Omnibus package adopted by the Council on 29 June 2026 has quietly postponed the law's most consequential obligations — those on high-risk AI systems — until December 2027 and August 2028. That two-track calendar, combined with a Trump executive order launching an "AI Litigation Task Force" against U.S. state laws and China's algorithm-registry regime, is producing the outcome global counsel spent 2025 warning about: three regulators are now converging on the same dozen foundation-model providers, but under three incompatible enforcement logics. The Foley & Lardner client alert published in July 2026 frames this as a compliance-planning problem. It is really a jurisdictional turf war, and Brussels is the one currently expanding its reach.

What actually applies on 2 August 2026

The law that enters full application in three weeks is not the law lawyers have been briefing on for two years. On 16 June 2026 the European Parliament, by 423 votes to 57 with 174 abstentions, adopted the "Digital Omnibus on AI," a Commission simplification package tabled on 19 November 2025. According to a European Parliament press release, the high-risk obligations in Chapter III, Sections 1–3 of Regulation (EU) 2024/1689 will now apply from 2 December 2027 for stand-alone high-risk AI systems and from 2 August 2028 for AI embedded as a safety component in products already covered by EU sectoral safety law. The Council of the EU gave final approval on 29 June 2026.

What kicks in on 2 August is therefore narrower than the original text suggested: transparency duties, governance architecture, market-surveillance powers, and — critically — the general-purpose AI (GPAI) obligations that already took effect on 2 August 2025. Watermarking of AI-generated content is delayed to 2 December 2026 for systems placed on the market before 2 August 2026, per the interinstitutional agreement text. Machinery products get a carve-out: the omnibus removes overlapping AI-Act requirements where the sectoral Machinery Regulation applies, a change the co-rapporteurs described as narrowing "safety component" to functions whose failure creates health or safety risk.

The fines remain unchanged. Article 99 of the AI Act sets maximum administrative penalties at €35 million or 7% of worldwide annual turnover — whichever is higher — for prohibited-practice violations, dropping to €15 million or 3% for high-risk breaches and €7.5 million or 1% for supplying incorrect information, as summarised in Cambridge's International Legal Materials. That penalty ceiling is roughly double the maximum under the GDPR.

The enforcement gap Brussels does not advertise

The reason the Commission tabled a simplification package a year before the law was due to bite is not just industry lobbying. It is that member states are not ready. The European Parliamentary Research Service, in its March 2026 briefing PE 785.670, reported that only 8 of 27 member states had designated their single point of contact for AI Act enforcement — despite a legal deadline of 2 August 2025. Harmonised standards under Standardisation Request M/613 to CEN-CENELEC JTC 21 remain in draft, according to a January 2026 academic mapping of AI-agent obligations under EU law. Conformity-assessment bodies for high-risk systems barely exist outside Germany, France and the Netherlands.

That mismatch — enforceable law, unbuilt enforcement apparatus — is why the Commission's own monitoring report to Parliament and Council, COM(2026) 234 final, warned in May 2026 that "the rules on the enforcement of [prohibited practices] will only apply as from 2 August 2026 and the national competent authorities are still in the process of being designated."

The compensating move is centralisation. The omnibus extends the AI Office's exclusive competence beyond GPAI models to cover AI systems where the model and the deployed system come from the same undertaking, and to AI integrated into very large online platforms designated under the Digital Services Act. In effect, Brussels is taking direct enforcement of everything OpenAI, Google, Anthropic, Microsoft, Meta, Mistral and Aleph Alpha ship into Europe out of member-state hands.

The Code of Practice is the real regulator

The instrument doing the actual work in 2026 is not the statute. It is the General-Purpose AI Code of Practice, whose final version the European Commission received on 10 July 2025 after 13 independent experts drafted it with input from more than 1,000 stakeholders. Twenty-six companies have signed, including Anthropic, Google, Microsoft, OpenAI, Mistral and Aleph Alpha, according to a peer-reviewed analysis in the European Journal of Risk Regulation. Meta refused. xAI signed only the Safety-and-Security chapter, opting out of transparency.

Under Article 56 of the Act, adherence is voluntary but creates a rebuttable presumption of compliance. Non-signatories must "demonstrate alternative adequate means of compliance for assessment by the Commission" — meaning more information requests, higher enforcement priority, and, per the same journal analysis, no mitigating factor when fines are calculated. That has turned a "voluntary" code into a de facto license. A Frankfurt Goethe law faculty analysis calls it "mandatory self-regulation." The AI Office has not yet fined anyone. It does not need to. The signatory list itself is the enforcement action.

Washington's counter-move

On the other side of the Atlantic, the Trump administration is not writing rules — it is dismantling them. The executive order of December 2025, "Eliminating State Law Obstruction of National Artificial Intelligence Policy," created an AI Litigation Task Force at the Justice Department with the "sole responsibility" of challenging state AI laws deemed unconstitutional, preempted, or inconsistent with federal policy. A March 2026 legislative framework urged Congress to codify federal preemption of "onerous" state AI laws, singling out California and Colorado.

The order withholds discretionary Broadband Equity Access and Deployment funding from states with laws Washington deems restrictive, and it directs the FTC to consider whether state disclosure or bias-mitigation mandates violate the federal prohibition on deceptive practices. The administration's AI Action Plan — released July 2025 — lists more than 90 federal actions to "remove red tape." It contains no federal risk classification, no conformity assessment, no fining authority for AI-specific harms.

The strategic bet is legible: let Brussels regulate, keep U.S. developers unregulated at home, and use export packages and procurement leverage to spread American models abroad. That works — until an American frontier developer wants to sell in Europe. Which is all of them.

China's third path

Beijing runs a different enforcement engine altogether. Under the Cyberspace Administration of China's algorithm-registry ("Beian") system, any generative-AI service with "public opinion properties or social mobilisation capacity" must file its algorithm, training-data description and safety self-assessment before deployment, according to a Carnegie Endowment analysis. A mandatory national content-labelling standard entered into force on 1 September 2025, per Carnegie's February 2026 update on AI-companion rules, giving Chinese regulators a live watermarking regime more than a year before the EU's equivalent obligation applies.

A Cambridge Forum on AI: Law and Governance article documents how the CAC uses mandatory technical standards under TC260 to fill statutory gaps — a mechanism structurally similar to the EU's harmonised standards under M/613, but executed on a Chinese state timetable rather than a Brussels consensus one. The overlap is enough that global compliance leads at U.S. hyperscalers now increasingly treat CAC filings and EU AI Office notifications as parallel exercises.

The extraterritorial squeeze

The Foley & Lardner alert's core observation — that an AI system can be classified differently across regimes, producing divergent compliance burdens — understates the problem. It is worse than divergence. The AI Act applies to any provider placing an AI system on the EU market or whose output is used in the Union, regardless of establishment, under Article 2. That extraterritorial hook, mirrored on China's side by the CAC's jurisdiction over any generative service accessible in mainland China, means U.S. frontier developers must comply with Brussels and Beijing simultaneously while their own government is actively litigating to prevent California from imposing anything similar.

The RAND Corporation's 7 July 2026 report on transatlantic AI cooperation frames this as a strategic-competition problem. A more accurate reading: the EU is running a compliance-driven regulatory land-grab against U.S. models, timed to activate at exactly the moment Washington has renounced the field. The Bruegel think tank has separately warned that AI Act uncertainty is already pushing European start-ups to collaborate with U.S. incumbents rather than compete, so the beneficiaries of the code-of-practice regime may end up being precisely the American giants Brussels claims to be constraining.

What to watch

• 2 August 2026: General date of application. First AI Office enforcement letters expected within weeks. Watch whether the first target is Meta (non-signatory) or a smaller open-source provider.
• 2 December 2026: Watermarking obligation applies; ban on AI-generated non-consensual intimate imagery activates. The Commission has to publish implementing guidance before then.
• Q4 2026–Q1 2027: The U.S. AI Litigation Task Force is expected to file its first suits against California's SB 53 and Colorado's AI Act. A federal-court injunction would signal how far Washington's preemption theory holds.
• 2 December 2027: The real deadline. High-risk stand-alone systems must be compliant. If harmonised standards are still not published, expect a second omnibus.

Diplomat View

The Digital Omnibus is not a retreat. It is Brussels buying time to fix its enforcement plumbing while locking in the two things that actually matter — a €35 million penalty ceiling and a centralised AI Office with direct jurisdiction over every foundation model sold in the single market. The forecast: within 12 months, the AI Office's Code of Practice becomes the de facto global compliance baseline for frontier models, because it is cheaper for OpenAI, Google and Anthropic to run one Brussels-tuned governance stack than three. Meta's holdout will not last past its first Article 101 information request. What would revise this call: a U.S. federal preemption statute passing Congress with an explicit extraterritoriality clause, or a CJEU ruling narrowing Article 2's territorial scope. Neither is likely before the December 2027 high-risk deadline hits.

The Bottom Line

The EU AI Act's 2 August 2026 activation is less a big-bang enforcement event than a controlled demolition of the fragmented compliance model global counsel built in 2024. Brussels bought itself two more years on high-risk rules and used them to centralise power over the handful of foundation-model providers that matter. In the trilateral contest with a deregulating Washington and a standards-heavy Beijing, the EU is not the toughest cop — it is the only one writing the rulebook everyone else's companies have to follow.