The EU AI Act Enforcement Is Live: What the First 60 Days Tell Us

Enforcement is live

On July 31, the European Commission confirmed that enforcement of the AI Act — including Article 50 transparency requirements — would begin on August 2. Regulation (EU) 2026/1744 (the Digital Omnibus) had been signed on July 8 and entered into force on July 27, formally pushing high-risk obligations to December 2027 and August 2028. But Article 50 was left out of that deferral.

The enforcement started faster than most expected. On August 29, the AI Office issued its first requests for information to GPAI providers — including OpenAI, Anthropic, and Google — covering model safety, independent evaluation, post-deployment monitoring, and training data disclosure. Incomplete or misleading responses carry fines of up to €15 million or 3% of global annual turnover. For comparison, GDPR took about eight months before its first significant enforcement action — CNIL’s €50 million fine against Google in January 2019. The AI Act took four weeks.

National enforcement, by contrast, has been slower to materialize. As of late August, no fine, formal Commission investigation, or market withdrawal order had been publicly confirmed under the AI Act, and member state readiness remains uneven — fewer than a third had formally notified their single point of contact as of March 2026. Reports circulating in September that authorities had begun inspecting automated résumé screening and HR decision tools were subsequently corrected: those categories sit under Annex III, and their obligations do not apply until December 2027. The practical risk today is not inspection. It is that Article 50 deployer-side obligations have no grace period and apply right now.

The enforcement model runs on two tracks. The AI Office handles GPAI model providers centrally — through compliance dialogues, information requests, model evaluations, and fines. National authorities handle everything else, including Article 50 deployer obligations. For companies operating across multiple EU markets, there’s an additional complication: readiness and interpretation are not uniform across member states — a divergence that mirrors what happened with GDPR. Compliance isn’t a one-time checkbox. It’s an ongoing assessment across jurisdictions.

What product teams must do now

If you’re a GPAI model provider, the RFIs made your obligations clear. But the more common blind spot is among the deployers — companies that build products on top of those models. Article 50 obligations are now enforceable, with fines of up to €15 million or 3% of global annual turnover. And they apply extraterritorially: if your SaaS or API-based AI service reaches EU users, you’re in scope regardless of where your company is headquartered.

Here’s what each obligation means for your product — not as a legal summary, but as a set of design decisions.

Chatbot and AI interaction disclosure

Any AI system that interacts directly with users must inform them they’re talking to AI — before or at the start of the first interaction. Not buried in terms of service. Not in a settings page. At the point of contact.

The Commission’s guidelines make clear that one-time disclosure may not be enough. In sensitive contexts — healthcare consultations, financial advice, emotional support — periodic reminders and context-aware disclosures may be necessary.

For product teams, this translates into three design decisions:

1. Placement. Where does the disclosure live? A persistent badge near the chat interface, an inline label within the conversation, or a modal at first interaction? Each carries different UX trade-offs. A badge is unobtrusive but easy to miss. A modal is clear but interruptive. The best implementations use both — a persistent visual indicator plus an explicit notice at the start of each session.
2. Context sensitivity. A routine FAQ query and a financial advice conversation are not the same. Your disclosure pattern should adapt — lighter for low-stakes interactions, more prominent and repeated for contexts where the user’s emotional state or material interests are involved.
3. Repetition triggers. When does the disclosure repeat? At the start of each new session? When the conversation topic shifts to a sensitive domain? When the system detects emotional escalation? These aren’t legal questions — they’re interaction design decisions that determine whether your disclosure feels like a natural part of the experience or an annoying popup.

AI-generated content marking

If your system generates synthetic text, images, audio, or video, the output must carry machine-readable metadata identifying it as AI-generated. This isn’t a visible disclaimer — it’s embedded infrastructure.

C2PA (Coalition for Content Provenance and Authenticity) is emerging as the de facto standard. The Code of Practice on Transparency of AI-Generated Content describes C2PA’s defining features — tamper-evident, signed, interoperable metadata — though it doesn’t name the standard in binding text. In practice, compliant systems are expected to implement three layers:

1. Signed metadata (C2PA-style content credentials) — provenance information that travels with the file.
2. Invisible watermarking — a signal embedded in the content itself, designed to survive compression, cropping, and format conversion.
3. Fingerprinting or logging — a fallback for cases where active marking fails or is stripped.

The challenge is durability. A screenshot, a re-encode, or a copy-and-paste can destroy C2PA metadata. No single technology solves this alone, which is why the layered approach matters. Anthropic’s implementation — invisible watermarking for text, C2PA content credentials for images — shows what a provider-side solution looks like in practice.

For product teams building on GPAI models, the critical question is the provider–deployer handoff. The model provider marks the output at generation. But you’re responsible for ensuring that marking survives your content pipeline — processing, editing, reformatting, publishing. If your pipeline strips metadata, you carry the compliance gap. Map every step between model output and user-facing content. Identify where marking could be lost. Build preservation into the pipeline, or implement re-marking before the content reaches users.

Legacy systems placed on the market before August 2 get a grace period until December 2, 2026 for this specific obligation. New systems placed on the market from August 2 onwards must comply immediately.

One important caveat: open-source AI systems are not exempt from Article 50 transparency requirements.

Emotion recognition and biometric categorization

If your system detects emotions or categorizes users biometrically, users must be informed specifically — not with a generic “we use AI,” but with a clear statement of what the system is doing: “this system is analyzing your emotional state” or “this system is categorizing you based on biometric data.”

This obligation catches more products than most teams realize. Sentiment analysis in customer service chatbots — interpreting whether a user is frustrated, angry, or satisfied to route them differently or escalate the conversation — is emotion recognition. Voice tone analysis in sales coaching tools — scoring a rep’s call based on how they sounded — is emotion recognition. Facial expression reading in video meeting platforms — detecting engagement or confusion — is biometric categorization. Each of these triggers Article 50 if deployed to EU users.

The design decision is specificity. You must tell the user what kind of data you’re processing and what you’re doing with it, and you must do it before the system starts processing them. This isn’t a privacy policy update — it’s a real-time, in-context notification that the user sees before the interaction begins.

Deepfake disclosure

If your system generates or manipulates content that resembles real people, deployers must disclose that the content is artificially generated. There’s a carve-out for artistic, creative, satirical, or fictional works — but even those require disclosure in a manner that doesn’t hamper the display or enjoyment of the work. AI-generated text published on matters of public interest requires disclosure too — with one exception that matters if you publish: content that has undergone human review or editorial control, where a natural or legal person holds editorial responsibility for the publication, is exempt.

AI literacy: the obligation you may have missed

While Article 50 gets the headlines, there’s a separate obligation that has been enforceable since February 2025 and applies to every organization using AI in the EU: AI literacy. Article 4 requires providers and deployers to take measures to support the development of AI literacy among their staff and anyone operating AI systems on their behalf. The Digital Omnibus softened this in July 2026 — it no longer requires guaranteeing any specific level — but it remains a binding obligation of means. This means training your teams — not just engineers, but product managers, customer support, sales, anyone who interacts with AI systems in their work — on the capabilities, limitations, and risks of the AI they use.

If your product team has nothing to show for this obligation, you’re already behind — it has been live for over eighteen months.

What comes next

Article 50 enforcement is active. But three more deadlines are approaching, each escalating in scope.

December 2, 2026: watermarking grace period ends

Providers of generative AI systems placed on the EU market before August 2 must have machine-readable content marking in place by this date. The grace period applies only to the Article 50(2) marking obligation — chatbot disclosure and deployer-side deepfake disclosure have been enforceable since August 2 with no grace period.

If you’re relying on the December 2 runway, start now. Decide your marking architecture: C2PA-style content credentials, invisible watermarking, or both. Test durability across your content pipeline. Track the Code of Practice on Transparency — it’s the EU-endorsed compliance framework, and its interoperability expectations extend into early 2027.

December 2, 2027: high-risk AI obligations

The Omnibus gave the high-risk regime an additional 16 months. Stand-alone high-risk systems under Annex III — credit scoring, employment screening, biometric identification, healthcare triage, access to essential services — must fully comply by this date. Requirements include risk management systems, technical documentation, conformity assessments, human oversight mechanisms, and incident reporting with tiered deadlines — two days for widespread infringement or critical infrastructure, 10 days where a death is involved, and 15 days otherwise.

Sixteen months sounds comfortable. The first 60 days of Article 50 enforcement proved otherwise. Human oversight, explainability, and audit logging are architectural decisions — they shape your data model, your interface, and your backend. They can’t be bolted on in the final quarter.

August 2, 2028: regulated product AI

High-risk AI systems embedded in regulated products — medical devices, vehicles, aviation, machinery — must comply by this date, under both the AI Act and sector-specific EU product safety legislation.

EU AI Act compliance as a product constraint

Sixty days of enforcement have established the pattern. Compliance dialogues, then information requests, then investigations. The EU isn’t waiting years to act. And the slower pace of national enforcement is not reassurance — it is a lag, and lags close.

The teams that built transparency into their product architecture aren’t reading these headlines with anxiety. The teams that treated the Omnibus delay as a general reprieve are now discovering that the part of the AI Act closest to their users — the part that changes their interface, their content pipeline, their disclosure patterns — has been enforceable for two months.

The next deadline is December 2. If your product generates AI content, start with the watermark. If it has a chatbot without disclosure, start there — that obligation has no grace period and no runway left. And if your teams haven’t had AI literacy training, you’re already behind on a regulation that’s been live since February 2025.

Key takeaways

1. Article 50 transparency obligations took effect August 2, 2026 on schedule. The AI Office sent formal information requests to GPAI providers within four weeks — faster than any comparable EU regulatory regime.
2. National enforcement has been slower and more uneven than the central AI Office track — but readiness and interpretation already diverge by jurisdiction, so multi-market compliance is not a single exercise.
3. Each Article 50 obligation requires specific product design decisions: where disclosure lives in your interface, how your content marking pipeline preserves metadata, when and how you notify users about emotion recognition.
4. The provider–deployer handoff for AI-generated content marking is the most common compliance gap. If your content pipeline strips the model provider’s metadata, you carry the liability.
5. Next deadlines: December 2, 2026 (watermarking grace period ends), December 2, 2027 (high-risk Annex III), August 2, 2028 (regulated product AI). AI literacy obligations have been live since February 2025.