Never lose a customer to a missed message
An AI agent trained on your own business, replying in seconds, in any language, on every channel your customers already use.
EU AI Act enforcement powers over general-purpose AI model makers took effect on August 2, 2026. Giving the European Commission the ability to investigate. Fine or even force a model off the EU market. The rules are now actively shaping how OpenAI, Anthropic and other providers operate in Europe.
The milestone does not mean any company has broken the law. It means Brussels can now use the full toolkit the AI Act created for general-purpose AI. Rather than relying on obligations that technically applied but carried no real enforcement teeth.
What EU AI Act enforcement actually allows regulators to do
The European Commission can now request information directly from model providers. Run its own evaluations of a model’s behaviour. Order corrective measures such as risk mitigations. The most severe option on the table is withdrawing a model from the EU market entirely. Fines can reach 15 million euros or 3% of a company’s worldwide annual turnover. Whichever is higher under the Act’s formula.
Reporting on the milestone named OpenAI and Anthropic specifically as firms now facing closer scrutiny. Stressing that neither has been found to have violated anything. Providers of models considered to carry systemic risk face additional duties, including model evaluations. Risk assessment, serious-incident reporting and cybersecurity requirements.
Why the timing matters for AI companies
Obligations on general-purpose AI providers have technically applied since August 2, 2025. Enforcement power only caught up a year later. Models placed on the EU market before that original 2025 date get a longer runway. Compliance required by August 2, 2027. That staggered timeline means different AI products face different compliance clocks depending on exactly when they launched in Europe.
For companies building AI products for a global audience. The practical effect is that European regulatory risk has shifted from theoretical to real. A formal information request or evaluation order from Brussels now carries actual legal weight. Where a year ago it largely did not.
The bigger regulatory picture
The EU AI Act enforcement regime is widely seen as the most comprehensive attempt by any major regulator to govern general-purpose AI systems directly. Rather than relying on existing consumer protection or competition law. Other jurisdictions, including the United States, have taken a lighter-touch approach so far. Means global AI providers now face meaningfully different compliance burdens depending on where their users are based.
What happens if a provider falls foul of the rules
The Commission’s escalation ladder runs from an information request through evaluation. Corrective orders, fines and, in the most serious cases, market withdrawal. No provider has reached the top of that ladder so far. Watch for the Commission’s first formal investigation under these powers as the real test of how aggressively Brussels intends to use them.
Companies with models already live in the EU should expect more detailed information requests over the coming months as regulators build out their evaluation capacity. Even without any public finding of wrongdoing.
See also
For how AI companies are being scrutinised on the other side of the Atlantic. Read our coverage of theNew York City Council’s AI hearing with OpenAI, Anthropic, Google and Meta, and our report on the Apple-OpenAI trade secrets hearing set for October 14.
How this differs from the US approach
Unlike the EU’s rules-first model. The United States has so far relied on a mix of voluntary commitments and existing law to address AI risk. Without a dedicated enforcement regime comparable to the AI Act. That gap means a model that draws no regulatory attention in the US can still face a formal information request or evaluation order the moment it is offered to users in the EU.
What compliance actually looks like day to day
For an AI company, meeting EU AI Act obligations typically means maintaining detailed technical documentation of a model’s training data. Capabilities and known limitations, plus systems for reporting serious incidents and demonstrating cybersecurity safeguards. Providers of the largest, most capable models face the heaviest documentation burden under the systemic-risk category.
None of this happens through a single filing. Compliance is an ongoing process. Is part of why the Commission’s enforcement powers matter. They give regulators a formal way to check whether that ongoing process is actually being followed. Rather than relying on self-certification alone.
Frequently Asked Questions
When did EU AI Act enforcement powers take effect?
The European Commission’s enforcement powers over general-purpose AI model providers took effect on August 2, 2026.
Which companies are affected by EU AI Act enforcement?
Any company placing a general-purpose AI model on the EU market. Whether based inside or outside the EU. Is covered; reporting has specifically named OpenAI and Anthropic as facing new scrutiny.
What can the European Commission actually do under these powers?
It can request information, evaluate models, order corrective measures. Impose fines of up to 15 million euros or 3% of global turnover. In the most serious cases force a model off the EU market.
Has any AI company been fined under the EU AI Act?
Not as of this enforcement milestone. The activation of these powers does not establish that any provider has violated the Act.
Do older AI models have more time to comply?
Yes. Models placed on the EU market before August 2. 2025 have until August 2, 2027 to meet the full set of obligations.
Sources
- Let’s Data Science — EU activates AI Act powers over model providershttps://letsdatascience.com/news/eu-activates-ai-act-powers-over-model-providers-1db889b5
Verification your users actually receive.
Send one-time passcodes over WhatsApp with a single API call. Replio can generate, hash and verify the code for you.
