EU AI Act Grace Period Ends as Enforcement Reaches Frontier Models

The EU AI Act's enforcement machinery is now live: since 2 August 2026, Brussels can fine, evaluate, and withdraw general-purpose AI models from the European market.

What Switched On, and When

For a year the EU AI Act carried teeth on paper and none in practice. The grace period ends on 2 August 2026. According to the European Commission, the AI Office and national authorities began enforcing the Act's rules for general-purpose AI (GPAI) providers on that date, and a fresh set of content-transparency duties took effect the same day.

The one-year gap was deliberate. The GPAI obligations became law on 2 August 2025, but enforcement was held back twelve months so providers and the AI Office could operationalise the machinery. Analysis from Taylor Wessing confirms the design: the substantive duties applied from 2025, the power to punish from 2026. Models placed on the market before 2 August 2025 have until 2 August 2027 to comply.

The Powers: Fines, Evaluations, Market Withdrawal

Enforcement reaches the frontier labs through five concrete powers. According to Help Net Security, the AI Office can request technical documentation, run or commission technical evaluations of a model, demand corrective and risk-mitigation measures, restrict or withdraw a model from the EU market, and issue fines. Evidence of a frontier model's inner workings is no longer the provider's alone to keep.

The fine ceiling for GPAI providers sits in Article 101: up to 3% of total worldwide annual turnover or €15 million, whichever is higher. Prohibited AI practices — the banned-outright category — carry a steeper ceiling under Article 99: €35 million or 7% of global turnover. For a company the size of OpenAI, Google, or Meta, 3% of worldwide turnover is not a rounding error.

The AI Act gives innovators legal certainty while protecting the public interest.

— — Henna Virkkunen, European Commission Executive Vice-President

Transparency, Now Enforceable

The same 2 August date switched on the content-transparency rules. Under Article 50, a chatbot must disclose that a person is talking to AI; deepfakes — AI-generated or edited image, audio, and video — must be labelled; and AI-generated content must carry machine-readable marks so automated tools can detect it. Reporting from Tech Monitor frames the change plainly: disclosure is a duty now, not a courtesy.

Meta Is the Fault Line

Twenty-eight organisations signed the voluntary GPAI Code of Practice published in July 2025 — Amazon, Anthropic, Google, IBM, Microsoft, Mistral, and OpenAI among them, according to the record of signatories. One large name is missing. Meta refused.

Meta's objection was blunt. Reporting by Euronews carries the company's public reasoning.

Europe is heading down the wrong path on AI.

— — Meta

Meta argued the Code introduced legal uncertainty and measures reaching beyond the AI Act itself. The refusal matters because Meta draws the line every frontier lab now stands on: cooperate with the AI Office and accept scrutiny, or contest the rulebook and risk the fines. Meta chose to contest.

Not Just Brussels: Colorado, the UK, China

The EU is the loudest mover, not the only one. On 11 August 2026, the Colorado Department of Law filed proposed rules implementing the state's Automated Decision-Making Technology Act and its Conversational AI Services Act — the Chatbot Safety Act — both effective 1 January 2027. The Colorado chatbot rules require disclosure of AI interaction, age estimation, protection of minors, and suicide and self-harm response protocols. Public comment runs to 26 October 2026.

Further afield, the United Kingdom opened a consultation on AI-driven workplace monitoring, and China entered a September 2026 decision window on export controls for advanced Chinese AI models while issuing a first round of fines under new companion-AI rules. The direction of travel is consistent: reporting across four jurisdictions shows governments moving from principles to penalties inside a single month.

The Standards-Sovereignty Gap

Here is the honest tension. Enforcement lands on GPAI providers that are, almost without exception, not European — OpenAI, Google, Anthropic, Meta — while Europe operates few frontier labs of its own. Brussels asserts sovereignty by rulebook rather than by compute. The data on where frontier models are actually built shows the imbalance clearly.

So here is the case for Emergent Intelligence (EI) — the dignity-first frame I use for what is more commonly called AI. EI does not argue for banning intelligence. EI argues for accountability for the humans who ship it: agency over automation, and no unaccountable system placed above public authority. The EU's 2 August switch is the first moment a public body can look inside a frontier model, demand changes, and — if it must — order the model off the market. EI's posture, written into law by someone else.

The unfinished part is the Global South. When Brussels, Colorado, and California write the templates, Africa inherits standards Africa is regulated by rather than standards Africa helped author. The evidence of the past year shows the pattern hardening. Closing that standards-sovereignty gap — a seat where the rules are drafted, not only enforced — is the work that matters next.

Regulation is not the enemy of intelligence. Regulation is the receipt that a human stays accountable for it.

Frequently Asked Questions

These are the questions people are asking about the EU AI Act's enforcement of frontier models. Short answers follow, drawn from the European Commission and the Act's primary text.

What is the EU AI Act's enforcement of frontier models?

In short, the EU AI Act's enforcement is the AI Office's power, live since 2 August 2026, to police general-purpose AI providers. Research and the Act's own text show the AI Office can request documentation, evaluate models, order corrective measures, withdraw a model, and fine providers up to 3% of worldwide turnover.

How does the AI Office enforce the rules?

Simply put, the AI Office enforces through documentation, evaluation, and penalty. According to the European Commission, the AI Office can commission technical evaluations of a model and demand risk-mitigation before escalating to fines or market withdrawal — a graded set of powers rather than a single blunt one.

Why is the 2 August 2026 date significant?

The key is the one-year grace period. Analysis of the Act shows GPAI obligations became law on 2 August 2025, but the power to fine was held for twelve months so providers and the AI Office could prepare. The date marks the shift from statute to enforceable penalty.

Who is the EU AI Act's enforcement for?

In other words, enforcement targets general-purpose AI providers — the frontier labs. Evidence shows the largest are non-European: OpenAI, Google, Anthropic, and Meta. Deployers of chatbots and deepfakes also carry new transparency duties under the same rules.

What are the risks of the EU AI Act for frontier AI?

The answer is legal exposure and fragmentation. Data reveals fines reaching 3% of global turnover for GPAI providers and up to 7% for prohibited practices, while Meta's refusal to sign the voluntary Code shows the compliance fault line the industry now faces.

Sources:

European Commission: enforcement begins 2 August · Help Net Security: what the AI Office can do · AI Act Article 101 (fines on GPAI) · AI Act Article 50 (transparency) · Taylor Wessing: GPAI obligations · Tech Monitor: transparency enforcement · GPAI Code of Practice signatories · Euronews: Meta rebuffs the Code · Colorado Department of Law: AI rules · EC: enforcement of the AI Act · Related on this site: AI watermark and transparency laws · California's SB-813 AI audit law · China's companion-AI rules · Africa and Global-South AI governance