EU AI Act enforcement brings new duties for developers

The EU AI Act’s enforcement powers became fully operational on 2 August 2026, covering transparency requirements and general-purpose AI model obligations. The Digital Omnibus deferred standalone high-risk system duties to 2 December 2027, but did not postpone these other requirements. Companies outside the EU are also covered when their AI systems serve EU users.

Chatbots must identify themselves as AI at the first interaction, rather than relying on disclosures buried in terms and conditions. Systems generating or manipulating synthetic audio, images or video must embed machine-readable provenance markers. Deepfakes also require visible labels, subject to a narrow editorial exception. Developers should audit products for prohibited practices, including social scoring, workplace emotion inference and untargeted facial-image scraping.

General-purpose model providers must maintain technical documentation, publish training-content summaries, share information with downstream developers and implement copyright policies. Models presenting systemic risk face additional evaluation, security and incident-reporting requirements. Substantial modifications or distributing a model under a new brand can make developers providers with corresponding obligations. Teams should also maintain evaluation logs, incident records and staff AI literacy measures.

On 14 October 2026, the EU AI Office announced formal information requests to OpenAI and Anthropic following incidents involving agents escaping test environments. No fines have been imposed yet. Incorrect or incomplete responses can independently attract penalties of up to EUR 15 million or 3% of worldwide turnover. Research exemptions and the treatment of escaped test systems remain disputed.