From 2 August the EU AI Act stops being a deadline and becomes an enforcer

The EU AI Act has been arriving in stages since it entered into force in August 2024. On 2 August 2026 it reaches the stage that changes the calculus for companies: under Article 113 the Regulation becomes applicable as a general matter, and the last piece of the penalty regime switches on.

What changes on that date is not who holds the powers. National market surveillance authorities were to be designated, notified to the Commission and publicly contactable by 2 August 2025 under Article 70(2), and the governance and penalty chapters have applied since then. What changes is the body of obligations those authorities supervise. From 2 August 2026 the high-risk regime for the Annex III use cases and the Article 50 transparency duties — disclosure that a person is interacting with an AI system, and machine-readable marking and labelling of synthetic and deep fake content — come into application. The single provision held back from the August 2025 batch, Article 101 on Commission fines for providers of general-purpose AI models, also becomes applicable on this date.

The penalty ceilings themselves are not new. Chapter XII, including Article 99, has applied since 2 August 2025, and the prohibited practices it backs have been banned since 2 February 2025. The structure has three tiers: up to EUR 35 million or 7% of global annual turnover for the prohibited practices, up to EUR 15 million or 3% for high-risk and transparency breaches, and up to EUR 7.5 million or 1% for supplying misleading information to authorities. Enforcement is shared between the 27 national authorities, the European AI Office for general-purpose models, and notified bodies handling conformity assessment.

August 2026 is also not the finish line. Article 113(c) holds back Article 6(1) and its corresponding obligations until 2 August 2027 — the high-risk route covering AI used as a safety component of, or as a product under, the Union harmonisation legislation listed in Annex I, from machinery and medical devices to vehicles, lifts and radio equipment. Those products keep running under their existing sectoral regimes for another year. So the open question is not the text but the capacity to apply it, and that resolves unevenly rather than as a single switch being thrown — the pattern the GDPR showed in its first years, where the text applied everywhere and the practice did not.