Who this is for: Compliance officers, AI product managers, legal teams, and engineering leads at organizations deploying or providing AI systems that interact with EU users or markets. Relevant regardless of where your organization is headquartered.
This guide is a companion to the existing preparation checklist. That guide covered how to prepare. This guide covers how to act now that enforcement is live.
Contents
1. What Became Enforceable on August 2, 2026 2. What Is NOT Yet Enforceable 3. What the AI Office Can Now Do 4. Your First 72 Hours: Immediate Actions 5. SWT3 Procedures That Produce Required Evidence 6. Common Misconceptions 7. Related Guides1. What Became Enforceable on August 2, 2026
Four categories of obligation are now subject to enforcement action by national competent authorities and the AI Office.
AI-Generated Content Labeling, Deepfake Disclosure, Emotion Recognition Notification
Deployers must ensure that individuals are informed when they interact with an AI system (unless obvious from context), when AI-generated content is presented as real (deepfakes), and when emotion recognition or biometric categorization systems are in use. Providers of AI systems generating synthetic content must ensure outputs are machine-detectable as artificially generated.
Technical Documentation, Copyright Policy, Content Summaries
Providers of general-purpose AI models must maintain and make available technical documentation describing training methodology, evaluation, and known limitations. They must publish a copyright compliance policy and make available a sufficiently detailed summary of training data content. These obligations apply to all GPAI models, not just those designated as systemic risk.
Already Enforced Since February 2, 2025
Prohibitions on social scoring, real-time remote biometric identification (with limited exceptions), manipulation of vulnerable groups, and untargeted facial image scraping have been enforceable since February 2025. They remain in full force. If you confirmed compliance during the February milestone, verify that no new system deployments have introduced prohibited capabilities.
Staff Competence for Deployers
Organizations deploying AI systems must ensure that staff involved in operating, overseeing, or making decisions based on AI outputs have sufficient AI literacy appropriate to the context. This is a deployer obligation, not limited to GPAI. Training records and competency evidence should be documented and accessible.
2. What Is NOT Yet Enforceable
The Omnibus amendment deferred several major categories. Teams should be aware of these deferrals to avoid spending resources on obligations that are not yet active.
Key distinction: "Deferred" does not mean "optional." These obligations will become enforceable. The Omnibus gave organizations additional time to prepare, not an exemption.
| Obligation | Original Date | Deferred To | Notes |
|---|---|---|---|
| High-risk AI system requirements (Annex III) | Aug 2, 2026 | Aug 2, 2028 | Risk management, data governance, technical documentation, human oversight, accuracy/robustness |
| Registration in EU database | Aug 2, 2026 | Aug 2, 2028 | Mandatory registration of high-risk AI systems before placing on market |
| Conformity assessment | Aug 2, 2026 | Aug 2, 2028 | Self-assessment or third-party conformity assessment for Annex III systems |
| Systemic risk GPAI evaluation methodology | Aug 2, 2026 | Ongoing | Obligations are enforceable, but the AI Office's evaluation methodology is still under development |
3. What the AI Office Can Now Do
The AI Office, operational since February 2024, has been building enforcement capacity for this date. As of August 2, 2026, the AI Office can take the following actions regarding GPAI providers.
- Request technical documentation from any GPAI provider, with binding deadlines for response
- Issue binding requests for information regarding model capabilities, training data, and risk mitigations
- Conduct evaluations of GPAI models, including through independent experts
- Impose fines up to 3% of global annual revenue (or 15 million EUR, whichever is higher) for GPAI violations
- Impose fines up to 1.5% of global annual revenue (or 7.5 million EUR) for supplying incorrect, incomplete, or misleading information in response to requests
- Coordinate with national competent authorities on cross-border enforcement
For Art. 50 and Art. 4 obligations: enforcement is handled by national competent authorities in each Member State, not the AI Office. Fines can reach up to 15 million EUR or 3% of global annual revenue. Each Member State sets its own enforcement procedures.
4. Your First 72 Hours: Immediate Actions
These are concrete steps your team can take in the first 72 hours after enforcement begins. Prioritized by exposure level.
- Verify Art. 50 transparency disclosures are active on all AI-facing products. Confirm that users are notified when interacting with an AI system. Check that synthetic content (images, audio, video, text) is labeled as AI-generated where required.
- Confirm GPAI technical documentation is current and accessible. If you provide a general-purpose AI model, verify that your technical documentation reflects the model currently in production, not a prior version.
- Review your copyright compliance policy for training data. The policy must be published and describe how you comply with EU copyright law, including the text and data mining (TDM) opt-out mechanism.
- Verify AI literacy training records for deployer staff. Confirm that personnel who operate, oversee, or make decisions based on AI outputs have documented training appropriate to their role.
- Confirm that Art. 5 prohibited practices controls remain in place. Review any new AI system deployments since February 2025 to ensure no prohibited capabilities were introduced.
- Identify which systems might qualify as "systemic risk" GPAI. The threshold is 10^25 FLOPs of cumulative compute for training. If any of your models cross this threshold, additional obligations apply (adversarial testing, incident reporting, cybersecurity measures, energy consumption reporting).
- Brief leadership on the enforcement timeline. Clearly communicate what is enforceable now versus what was deferred to 2028. This prevents both over-investment in deferred obligations and under-investment in active ones.
Each action above should produce a dated, attributable record. Anchoring these checks cryptographically creates a verifiable timeline showing your organization responded promptly to enforcement activation.
5. SWT3 Procedures That Produce Required Evidence
The following table maps each enforceable obligation to the SWT3 procedures that generate the corresponding evidence trail.
| Obligation | Article | SWT3 Procedures | What Gets Anchored |
|---|---|---|---|
| Transparency disclosure | Art. 50 | AI-TRANS.1, AI-WATERMARK.1 | Disclosure event timestamp, content marking method, machine-detectability verification |
| GPAI technical documentation | Art. 53 | AI-MDL.5, AI-MDL.6, AI-MDL.7 | Model weight hash, adapter stack, quantization parameters, version provenance |
| Copyright compliance policy | Art. 53 | AI-DATA.1, AI-LIC.1 | Training data provenance hash, licensing attestation, TDM opt-out compliance |
| AI literacy (deployers) | Art. 4 | AI-AUDIT.1 | Training completion records, competency assessments, role-based coverage |
| Prohibited practices monitoring | Art. 5 | AI-GRD.1, AI-SAFE.1 | Guardrail configuration, boundary enforcement, prohibited capability detection |
| Systemic risk evaluation | Art. 55 | AI-REDTEAM.1, AI-ROBUST.1 | Red team exercise results, adversarial testing outcomes, robustness metrics |
| Incident reporting | Art. 55 | AI-INCIDENT.1 | Incident classification, severity, response timeline, root cause analysis |
from swt3_ai import Witness
w = Witness(tenant="YOUR_TENANT")
w.witness_transparency(disclosure_type="user_notification", method="banner")
# Or in TypeScript
import { Witness } from '@tenova/swt3-ai';
const w = new Witness({ tenant: 'YOUR_TENANT' });
w.witnessTransparency({ disclosureType: 'user_notification', method: 'banner' });
6. Common Misconceptions
"I'm not in the EU, so this doesn't apply to me."
The AI Act has extraterritorial reach. It applies to any provider placing an AI system on the EU market or putting it into service in the EU, and to any deployer established in the EU or using AI output within the EU. If your AI system's output is consumed by EU users or affects EU individuals, the obligations can apply regardless of where your organization is headquartered.
"The Omnibus delayed everything."
The Omnibus amendment deferred only high-risk (Annex III) requirements to August 2, 2028. Transparency obligations (Art. 50), GPAI obligations (Chapter IX), prohibited practices (Art. 5), and AI literacy requirements (Art. 4) are all enforceable now. Treating the Omnibus as a blanket delay creates significant exposure.
"We only need to worry if we're a GPAI provider."
Deployers have independent obligations. Art. 50 transparency requirements and Art. 4 AI literacy requirements apply to deployers directly. You do not need to be a GPAI provider to face enforcement. If you deploy any AI system that interacts with EU individuals, you have obligations today.
"Enforcement won't start immediately."
The AI Office has been operational since February 2024. It has spent over two years building enforcement capacity, developing Codes of Practice, and engaging with GPAI providers. National competent authorities in Member States have similarly been designating enforcement bodies. Belgium has already imposed a 4.2 million EUR fine for AI-related violations. The infrastructure for enforcement exists and is staffed.
7. Related Guides
- EU AI Act Crosswalk, full article-by-article obligation mapping
- EU AI Act August 2026 Checklist, pre-enforcement preparation guide
- EU AI Act Cheatsheet, quick reference card
- GPAI Code of Practice Mapping, CoP commitments to SWT3 procedures
- EU AI Omnibus Agreement, what changed and what was deferred
- FRIA/DPIA Evidence Mapping, Art. 27 and Art. 35 impact assessment evidence
- GDPR Article 17 Mapping, right to erasure in AI contexts