EU AI Act becomes generally applicable as enforcement and transparency rules begin

The EU AI Act became generally applicable on 2 August 2026, and from that date the Commission's AI Office and national authorities began enforcing it. The same day, transparency duties for chatbots, deepfakes and machine-readable marking of AI-generated content started to apply.

What it is

This was the date the 2024 regulation originally set for most of its rules. It did not bring in everything: the AI Omnibus had already moved high-risk rules for listed sensitive uses to 2 December 2027 and those for AI embedded in regulated products to 2 August 2028. What did arrive was enforcement capacity plus the transparency chapter. The Commission also published an initial list of more than 180 organisations signed up to its code of practice on transparency of AI-generated content.

What it requires

Chatbots and other interactive systems must tell users they are dealing with AI rather than a person. Deepfakes must be labelled, and generated or altered content must carry machine-readable marks so it can be detected. Labelling also reaches text published to inform the public where no human review or editorial control took place. Market surveillance authorities, the AI Office and, for EU bodies, the European Data Protection Supervisor enforce these rules, with company fines of up to €15 million or 3% of global annual turnover.

What security leaders should do

Machine-readable marking is also a detection opportunity. Ask email, collaboration and fraud-prevention vendors whether they read AI-content marks, and whether they can flag unmarked synthetic media in payment-approval or executive-impersonation workflows. For your own customer-facing assistants, check that every entry point discloses the AI and that the disclosure survives integrations with messaging apps and voice channels. Record which team owns each disclosure so enforcement questions reach the right person.