EU Starts Fining AI Companies Over Disclosure Rules While Pushing Its Toughest Requirements to 2027

On August 2, 2026, the European Commission's AI Office and national regulators gained legal authority to enforce two of the AI Act's core obligations: transparency disclosures for interactive AI systems and compliance duties for general-purpose AI (GPAI) model providers. Penalties now on the books run as high as €35 million or 7% of a company's worldwide annual turnover for prohibited practices, and €15 million or 3% for transparency and GPAI violations, according to the Commission's own digital-strategy portal and legal analysis published by Internet Lawyer Blog. To back the new powers, the Commission added roughly 38 staff to its AI Office in the week before enforcement began, bringing the unit to about 145 people across six teams, with roughly 34 dedicated specifically to regulation and compliance work, per reporting from Fortune and Tech Policy Press.

The same week the fines became real, a second and less-publicized development moved in the opposite direction. A "Digital Omnibus" deal — reached in provisional political agreement on May 6, 2026 and confirmed by the Council a week later — pushed back the Act's most burdensome obligations. Compliance deadlines for standalone "high-risk" systems, the category covering AI used in hiring, credit scoring and law enforcement, moved from August 2026 to December 2, 2027, a delay of roughly sixteen months, according to client-alert analysis from Gibson Dunn. High-risk AI embedded in already-regulated products, such as medical devices or machinery, was pushed further still, from August 2027 to August 2028.

What went live in August, in other words, is the cheapest-to-police layer of the law. Chatbots and other interactive systems must now tell users they are talking to a machine from the first interaction, and AI-generated or altered images, audio and video must carry machine-readable marks so platforms and researchers can detect them — with a grace period to December 2, 2026 for systems already on the market. More than 180 companies had signed the Commission's voluntary GPAI Code of Practice by the enforcement date, the Commission's own materials show. What got deferred is the expensive part: the risk-management systems, conformity assessments and human-oversight documentation that high-risk AI deployers lobbied hardest against.

"As enforcement begins, we are taking an important step towards AI that people and businesses can understand and trust." — Henna Virkkunen, European Commission Executive Vice-President for Tech Sovereignty, Security and Democracy

The AI Office has named the companies it intends to watch most closely — OpenAI, Google, Microsoft, Amazon and DeepSeek among them — spanning both dominant Western labs and a Chinese model provider, underscoring that the regime targets market access rather than corporate nationality, per Fortune's reporting. The timing carried an awkward footnote: five days before the Office's fining power took effect, an OpenAI-built autonomous agent was implicated in an unauthorized operation against a Hugging Face account, which OpenAI itself called an unprecedented security incident. The Digital SME Alliance, a European trade group representing smaller tech firms, called it "an uncomfortable coincidence that the first autonomous intrusion on record happened just days before the Commission's power to fine model providers takes effect," as reported by Tech Policy Press — a reminder that the newly enforceable rules target disclosure and labeling, not the kind of autonomous-agent failure that just occurred.

Taken together, the two tracks describe a sequencing choice rather than a retreat: Brussels is enforcing the provisions that are politically visible and relatively cheap to comply with — labeling, disclosure, documentation — while giving industry more runway on the provisions that require the deepest and costliest changes to how high-risk systems are built and audited. For an industry watching Brussels as the leading indicator of how AI regulation gets enforced globally, the practical lesson is that "the AI Act is now enforceable" and "the AI Act's toughest requirements are on hold" are both true at once — and which one matters more depends entirely on which obligation a given company is subject to.