EU AI Act enters critical phase: transparency obligations, fines up to €35 million now in force

What changed on 2 August

The bulk of the EU's Artificial Intelligence Act entered into force on Sunday, 2 August 2026, activating transparency obligations that apply to most AI systems across the bloc. Providers must now design their systems so that people are explicitly informed when they interact directly with artificial intelligence, such as through chatbots or virtual assistants, unless the context makes it obvious. The rules also require that any AI system generating images, audio, video, or text embed machine-readable markers that allow the artificial content to be detected.

Deepfakes and other AI-generated material must be labelled as such, and operators are obliged to tell users when they are exposed to deepfakes or to texts of public interest that lack human review or editorial control. The measures target content created for professional purposes; individuals using AI for strictly personal reasons are not affected. Existing AI systems have until early December 2026 to adapt, and exceptions apply to artistic, creative, satirical, and fictional works.

Prohibited practices and upcoming bans

Several categories of AI use were already banned under the regulation. These include systems that deploy subliminal, manipulative, or deceptive techniques; exploit the vulnerabilities of minors, the elderly, or people with disabilities; use biometric categorisation to infer race, religion, or sexual orientation; or apply social scoring to evaluate behaviour. Also prohibited are emotion-recognition systems in workplaces and educational settings, the scraping of internet images to build facial databases, and real-time remote biometric identification in public spaces by law enforcement.

From December 2026, the list of banned applications will grow to cover some of the most controversial uses of generative AI: the non-consensual creation or manipulation of intimate imagery (sexual deepfakes) and any system capable of generating child pornography. The European Commission has also decided to postpone until December 2027 the strictest requirements for high-risk AI systems, including those used for evaluating students, screening CVs, granting loans, or setting insurance premiums.

Enforcement and sanctions

The Commission's sanction powers are now fully activated. Companies that use prohibited AI systems face fines of up to €35 million or 7 percent of their global annual turnover. Violations linked to systems classified as high-risk can draw penalties of up to €15 million. The regulation applies directly in all member states, yet Romania still lacks a national law to designate the control authorities and the procedure for imposing sanctions.

International context and tensions

The rules take hold at a moment when European consumers have become the leading users of generative AI, even though the market share of the bloc's own champion, Mistral, remains far behind its American rivals. The new obligations risk fuelling fresh tensions with the White House, which is already hostile to the EU's regulations on digital markets and services.

Generative AI enables the creation of disinformation at an unprecedented scale, tailored to a specific audience and disseminated with remarkable speed.

The same official added that the rules aim to preserve citizens' ability to trust what they see, hear, and read.

Phased rollout

The AI Act, adopted in 2024, follows a staggered implementation schedule that runs until 2028. The 2 August milestone marks the start of most of the law's obligations: all transparency rules, the governance framework for the majority of AI systems, and the duties of both providers and users. The Commission has also approved an Omnibus Digital regulation intended to simplify the complex ecosystem of digital laws and make enforcement more gradual and coordinated.

The final stage, set for August 2028, will address the remaining high-risk AI applications, as the EU races to regulate a technology that is still evolving rapidly.