The EU AI Act’s first real deadline has arrived — and it’s not the one most teams were watching

The EU’s AI rulebook has finally stopped being a future tense problem.

As of 2 August 2026, the European Commission’s AI Office and national authorities can enforce parts of the AI Act that matter to everyday products: prohibited AI practices, rules for general-purpose AI models, and a set of transparency duties that reach chatbots, deepfakes and synthetic content. The catch is that the most expensive, operationally heavy requirements for high-risk systems were pushed back by the AI Omnibus, so a lot of companies are now facing a narrower but more immediate compliance burden than they expected. European Commission enforcement framework, AI Act FAQ, Wilson Sonsini alert

That split matters. It means the first wave of AI Act work is less about rewriting entire model pipelines and more about product hygiene: telling users when they are talking to AI, marking generated audio, image, video and text in machine-readable form where technically feasible, labeling deepfakes, and documenting what general-purpose model providers are doing with training data, copyright policy and downstream information sharing. Wilson Sonsini’s August 2026 alert says the AI Office now has authority to request information and documentation, obtain model access for evaluation, require corrective measures, and in serious cases fine providers up to the higher of €15 million or 3% of worldwide annual turnover. Wilson Sonsini alert

What is actually in force now

The European Commission’s own enforcement page says some enforcement powers of the AI Office and member-state authorities apply from 2 August 2026. The FAQ at the AI Act Service Desk says that date starts enforcement for prohibited practices, transparency obligations and parts of the governance framework. In practice, that means product teams can no longer treat the Act as a long-range policy discussion if their systems touch users directly. European Commission enforcement framework, AI Act FAQ

The immediate obligations are the ones most likely to show up in release checklists:

• chatbots and virtual assistants must notify people that they are interacting with AI unless that is obvious;
• systems that generate or manipulate audio, image, video or text must carry machine-readable marking where technically feasible;
• deepfakes need disclosure;
• AI-generated or manipulated text published to inform the public on matters of public interest needs disclosure;
• emotion-recognition and biometric-categorization systems trigger notice duties;
• providers of general-purpose AI models must maintain technical documentation, a copyright policy and a sufficiently detailed summary of training content. Wilson Sonsini alert

The practical effect is that compliance has moved from legal abstraction into product design. If your customer support flow, content tool, recommendation layer or media feature uses AI in public-facing ways, the question is now what gets labeled, how the label travels with the output, and who inside the company owns the audit trail.

What was delayed

The headline risk many teams had been preparing for — the broad high-risk regime — did not start at the same time. The AI Omnibus postponed the principal requirements for high-risk AI systems, pushing the core deadline for stand-alone high-risk systems to 2 December 2027 and for high-risk systems embedded in regulated products to 2 August 2028. Wilson Sonsini says the August 2026 enforcement changes do not disturb that delay. Wilson Sonsini alert

That delay is not a free pass. It just means the heaviest operational work can be staged. Teams building credit, hiring, education or other Annex III systems still need to prepare risk management, oversight, documentation and internal governance, but the legal cliff edge is later than many planning decks implied. For now, the near-term pressure is on the higher-volume, more visible features that interact with users or publish generated content.

Where developers will feel it first

The first pain point is documentation. The second is labeling.

For model providers, the Commission’s materials and the legal alert both point to a more formal evidence trail: what model was used, what information is shared downstream, what copyright policy is in place, and how training data is summarized. That is not just a policy memo; it is the sort of record that product, legal and engineering teams will have to keep aligned if regulators ask for it. Wilson Sonsini alert

For deployers, the immediate operational issue is disclosure at the point of use. The user-facing burden is straightforward to describe and annoying to implement correctly: chat interfaces need a visible AI notice; AI-generated or altered content needs labels and, where required, machine-readable provenance signals; public-interest text cannot simply pass through a generative system without a disclosure decision. That means content workflows, CMS templates, moderation tools and product copy all need updates, not just legal review.

A simple internal checklist now looks more like this:

1. Inventory every AI feature in the product.
2. Identify whether the company is a provider, deployer, or both.
3. Map which features trigger transparency duties under Article 50.
4. Decide how labeling travels with generated outputs.
5. Confirm whether any model is subject to GPAI documentation duties.
6. Keep evidence for copyright policy, training-data summaries, and downstream disclosures.

That is the unglamorous part of the EU AI Act: not a dramatic ban, but a growing paperwork and product-design burden.

Enforcement is real, but still uneven

There is a strong argument that the practical effect of the AI Act will be modest until regulators prove they can enforce it consistently. Even the Commission’s own guidance points to a phased approach, with the AI Office and member states sharing responsibilities and the AI Office leaning on technical compliance dialogues as an initial tool before escalating. Wilson Sonsini notes that the AI Office has spent the past year in implementation mode and says those dialogues may continue and intensify after 2 August 2026. Wilson Sonsini alert

That is the counterargument worth taking seriously: rules on paper are not the same as a mature enforcement machine. Companies can still expect uncertainty at the edges, especially where a feature is borderline between a chatbot, a content tool and a workflow assistant, or where machine-readable labeling is technically awkward.

But the lack of perfect clarity is not the same thing as no rule. The Commission has now published the enforcement framework, the AI Act Service Desk FAQ says the first enforcement date is live, and a mainstream legal alert confirms the AI Office’s formal powers. For developers, that changes the risk calculation immediately: the sensible question is not whether the EU will ever care, but which parts of the product need to be auditable before the next release goes out. European Commission enforcement framework, AI Act FAQ, Wilson Sonsini alert

The takeaway

The AI Act’s first enforcement wave is not the sweeping high-risk regime many companies feared. It is narrower, more practical and already visible in product teams’ to-do lists: label the bot, mark the output, document the model, and keep the evidence ready. The bigger obligations are still coming later, but the era of treating the law as distant background noise is over.

For developers, the surprise is that the first real compliance work is less about frontier AI risk and more about ordinary product operations. For regulators, that may be the point.