On 2 August 2026, the AI Act changes nature
Adopted in 2024 and entering into force on 1st August of the same year, the European regulation on artificial intelligence (AI Act) is being implemented in stages. Prohibited practices have been banned since February 2025. Providers of general-purpose AI models, such as large language models, have been subject since 2 August 2025 to obligations regarding technical documentation, copyright compliance, and publication of a summary of training data. But for one year, the Commission could not penalize them.
This is what changed on 2 August 2026. On that date, the European AI Office, attached to the Commission, obtained its enforcement powers with respect to providers of general-purpose models: requesting information and documents, accessing models for evaluation, requiring risk mitigation measures, requesting the withdrawal or recall of a model, and imposing fines of up to 3 % of global annual turnover or 15 million euros, whichever is higher. Violations of prohibited practices remain subject to the heaviest penalties: up to 7 % of global annual turnover or 35 million euros. On the same day, transparency obligations came into effect: conversational agents must indicate that they are AIs, deepfakes must be labeled, and generated content must bear machine-readable markings.
A first wave of information requests
The AI Office did not wait long. On 29 August 2026, it sent its first formal requests for information to general-purpose model providers, in two parts. The first concerns the safety and security of the most advanced models, their external evaluations, and their post-market monitoring; according to Executive Vice President Henna Virkkunen, cited by Euractiv, some of the world's most advanced developers are among the recipients. The second targets more than thirty companies that had neither published a detailed summary of their training data nor participated in a compliance dialogue: they must explain how they comply with European copyright law. An incomplete or misleading response may itself be penalized.
This rapid start sends a political signal: the Union intends to demonstrate that its regulation is not a mere declaration of intent in the face of players whose economic power exceeds that of many states.
The code of practice, a dividing line between the giants
To facilitate compliance, the Commission published on 10 July 2025 a voluntary code of practice for general-purpose AI. Companies that sign it benefit from simplified compliance: oversight focuses on adherence to the code. Amazon, Anthropic, Google, IBM, Microsoft, and OpenAI have signed it, as have European companies Mistral AI and Aleph Alpha. xAI only signed the chapter on safety and security. Meta refused:
"Europe is on the wrong track with AI. […] This code introduces a number of legal uncertainties for model developers, as well as measures that go well beyond the scope of the AI Act." (Joel Kaplan, Director of Global Affairs at Meta, LinkedIn, 18 July 2025, Prometheus translation)
Not signing does not exempt one from the regulation: non-signatories must demonstrate compliance through other means and face more direct oversight.
Systemic risk models in the crosshairs
The regulation distinguishes a particular category: models presenting a 'systemic risk'. A model is presumed to be part of this category when the cumulative computing power used for its training exceeds 1025 floating point operations (FLOP). Their providers must assess and mitigate large-scale risks, report serious incidents, and guarantee a high level of cybersecurity. It is precisely these obligations that the first part of the AI Office's requests addresses.
A regulation already rewritten
The entry into the control phase coincides, however, with a retreat on other aspects. Proposed by the Commission on 19 November 2025, the 'digital omnibus' on AI was the subject of a political agreement on 7 May 2026, was approved by the European Parliament on 16 June and then by the Council, and entered into force on 27 July 2026 (Regulation (EU) 2026/1744). It postpones the application of rules on high-risk systems to 2 December 2027 for uses listed in Annex III (biometrics, education, employment, migrations, etc.) and to 2 August 2028 for AI integrated into regulated products. It relaxes the obligation of AI literacy, which becomes an obligation of means, extends certain alleviations to small medium-sized enterprises, and strengthens the powers of the AI Office over systems built from general-purpose models by the same group. Finally, it adds a new prohibition: systems generating non-consensual intimate images or child sexual abuse content will be banned from 2 December 2026.
This dual movement summarizes the European strategy: lighten and delay the rules that weigh on all companies, while concentrating control capacity on the most powerful model providers, mostly American.
What Europe gains, what it risks
The Union first gains a lever: legal access to information on how large models are trained, evaluated, and secured, which the industry giants did not publish spontaneously. For rights holders, the obligation to summarize training data opens a path to assert their rights. For European players like Mistral AI, common rules can also become a trust argument with public and private clients.
The risks are just as real. The first is effectiveness: a still-young regulator facing companies with considerable legal resources. The second is credibility: by postponing rules on high risk, Europe fuels suspicion of a regulation weakened before it has even been applied. The third is geopolitical: controlling models designed outside Europe depends on the Union's ability to withstand commercial and diplomatic pressures.
Sovereignty is not regulated alone
The AI Act alone will not create a competitive European ecosystem. It sets the rules of the game; it does not fund computing capacity, research, or businesses. The coming months will tell whether the first requests for information lead to corrective measures, or even sanctions. They will also tell whether Europe can support its regulatory ambition with an industrial policy up to the task. Failing that, it will remain what it is often criticized for being: a demanding referee in a game it does not play.
Sources : Commission, press release of 31 July 2026 ; AI Act Service Desk, application timeline ; Commission, AI Act enforcement framework ; Commission, transparency obligations, 2 August 2026 ; Matheson via Lexology, first requests for information, 25 September 2026 ; Commission, code of good practices and signatories ; TechCrunch, Meta's refusal, 18 July 2025 ; Commission, entry into force of the AI omnibus ; European Parliament, 16 June 2026 ; Commission, AI control (article 4).
