EU AI Act Enforcement Began August 2026 — And It Wasn't About High-Risk Systems

On 2 August 2026, the European Commission's AI Office and national market surveillance authorities gained real enforcement power under the EU AI Act — fines of up to €15 million or 3% of global annual turnover for obligations already in force. The same date brought Article 50's transparency rules into effect: disclosure requirements for chatbots, deepfakes, and AI-generated content.

Most organisations' AI Act planning has been organised around risk classification — is our system high-risk under Annex III, do we need a conformity assessment, when is our deadline. Article 50 doesn't fit that frame at all. It doesn't ask what your system does or how much harm it could cause. It asks whether the person on the other end of an interaction knows they're talking to a machine.

Two separate things landed on the same date

It's worth keeping these apart. First, enforcement capability: regulators can now investigate and fine violations of obligations that were already written into the Act, including the ban on prohibited practices and transparency duties for general-purpose AI providers. Before August 2026 these existed on paper; now they carry consequences.

Second — and more relevant to most businesses — Article 50 itself took effect. Any chatbot or interactive AI system deployed in the EU must disclose that a user is interacting with AI rather than a human, unless that's already obvious from context. Any AI-generated or AI-manipulated image, audio, or video must be labelled as such, and AI-generated content more broadly is expected to carry machine-readable markers identifying it as synthetic.

Why risk-tier thinking misses it

Risk classification is genuinely the right lens for the heaviest obligations — technical documentation, conformity assessment, human oversight — because those scale with potential harm. Article 50 doesn't scale that way. A customer-service chatbot answering basic account questions is about as low-risk as an AI system gets, and it's still inside an enforceable transparency obligation. A marketing team generating product images with an AI tool isn't running a high-risk system by any definition, and the output may still need a synthetic-content label.

The obligation tracks what a system does — talks to people, generates synthetic media — not how dangerous it would be if it failed. "We're not high-risk, so we have time" answers a question Article 50 never asked.

Deployers are on the hook too

Transparency duties under Article 50 aren't only a provider-side burden. Deployers — the organisation actually putting a chatbot in front of customers, or publishing AI-generated content — carry disclosure obligations of their own. Most companies using AI tools today are deployers of someone else's model or platform, not providers of one. Buying the tool from a vendor was never a shield against provider-level obligations, and it isn't one here either.

Two questions worth answering now

1. Does every AI-powered chat or voice interface your organisation runs — internal or customer-facing — clearly disclose, at the start of the interaction, that the user is talking to AI?
2. Does any AI-generated or AI-edited image, audio, or video your organisation publishes carry a visible or machine-readable label identifying it as such?

Neither question needs a risk-classification exercise to answer, and neither depends on how the rest of your AI Act programme is going. That's exactly why they're easy to miss on a checklist organised around risk tiers — and why they were enforceable the moment 2 August 2026 passed, not on some later date still to come.

If you want to check the rest of your AI estate as well, our EU AI Act compliance checker classifies each system and lists the obligations and deadlines that apply, in about 10 minutes.

This article draws on analysis originally published by Progeat, PROGEAT's AI strategy and agent architecture practice.