August 2: the EU AI Act gets teeth — and Brussels can now enforce.

Two EU developments landed in the last week, and both cut against the “the EU delayed everything” headline. First, the Digital Omnibus finalized eight concrete changes to the AI Act, now in force. Second — and this is the one to circle — on August 2, 2026 the European Commission’s enforcement powers over general-purpose AI (GPAI) providers switch on. The rules didn’t just get clarified. Brussels can now compel.

August 2: the AI Act gets teeth

GPAI obligations have technically applied since August 2, 2025 — but providers got a one-year grace period before anyone could enforce them. That grace period ends August 2, 2026. From that date the Commission (through its AI Office) can move from persuasion to compulsion: request documentation and information, evaluate models directly, order corrective measures, restrict or withdraw a model from the EU market, and impose fines.

The fines are not symbolic: up to €15 million or 3% of global annual turnover, whichever is higher, for breaches of the GPAI transparency and copyright obligations. This is the moment a year of “voluntary” GPAI compliance becomes a supervised regime with a regulator holding a pen.

The AI Office gets centralized, exclusive jurisdiction

Change #7 in the Omnibus is the structural one. The AI Office now holds exclusive supervisory competence over AI systems built on a GPAI model from the same provider or corporate group, and over AI integrated into “very large online platforms” and search engines under the Digital Services Act. Expanded Article 75 powers give it serious-incident reporting, conformity-assessment responsibility, clarified remote and on-site inspection powers — and the right to reclaim its enforcement costs from providers found non-conforming. Enforcement is moving from 27 national authorities toward one central EU regulator for the models that matter most.

The eight changes, in plain English

• 1. High-risk deadlines move out. Annex III / Article 6(2) high-risk obligations now apply 2 December 2027; Annex I (harmonization-law) high-risk systems 2 August 2028; AI used by public authorities must comply by 2 August 2030.
• 2. Two new bans. Article 5 now prohibits AI that generates non-consensual intimate imagery (“nudifier” apps) and CSAM — from 2 December 2026.
• 3. A GDPR path for bias testing. The Act extends the legal basis to process special-category data for bias detection and correction, under a “strict necessity” standard with safeguards. It does not require you to run bias detection — it makes doing it lawfully easier.
• 4. Sector-law overlap relief. Where existing sectoral law (e.g., the Machinery Regulation) already imposes equivalent requirements, the Commission can limit duplicate AI Act duties via implementing acts.
• 5. A narrower “safety component” test. An AI system counts as a safety component only if its purpose is preventing or mitigating risks to health and safety — not mere optimization or convenience.
• 6. Relief for “small mid-caps.” A new category (fewer than 750 employees; turnover ≤ €150M or balance sheet ≤ €129M) gets SME-style simplifications: lighter documentation, proportionate quality-management expectations, sandbox priority, and penalty caps.
• 7. Centralized enforcement by the AI Office (above).
• 8. Unified technical standards. The Commission must have one set of standards drafted that satisfies both the AI Act and existing harmonization law — one conformity path, not two.

What actually reaches a US company

Most US businesses are not GPAI providers, so the August 2 enforcement switch does not land on you directly. But three things do, or soon will:

• Transparency, on the original clock. The Article 50 duties — tell people they’re dealing with AI, label AI-generated and deepfake content — were not delayed. And the deadline to mark synthetic content for systems already on the market got shorter: 2 December 2026.
• The new bans. If any product of yours could generate the prohibited content, the 2 December 2026 prohibition reaches it regardless of size.
• Downhill vendor diligence. If you build on a GPAI model, your vendor is now a supervised, fineable entity. Their compliance posture — and their willingness to give you the documentation the AI Office can demand of them — just became part of your own diligence.

An honest limitation

These are the amendments as enacted in Regulation (EU) 2026/1744 and summarized by counsel (Orrick, and the EU AI Office’s own materials); several mechanics — the sector-overlap implementing acts, the unified standards, the exact scope of “exclusive” AI Office jurisdiction — will be worked out in delegated and implementing acts over the next two years. Treat specific dates and thresholds as reported-and-current, and verify against the primary instrument before relying on any figure. The one thing that is concrete today: as of 2 August 2026, GPAI enforcement is real, and it has a number attached.

This briefing is general information from Sentinel Assurance Group, not legal advice. Regulatory dates and requirements change — we maintain these briefings, but verify against primary sources and counsel before acting. Last reviewed July 30, 2026.

See how a Gap Assessment maps your exposure →