European Union: AI regulation & deadlines

Prohibited AI practices (Art. 5)

Binds All providers & deployers of AI systems in the EU. Bans on social scoring, manipulative AI, untargeted scraping.

Stated maximum penalty — Up to 7% global turnover or €35M

GPAI obligations incl. Annex XI energy/compute docs

Binds Providers of general-purpose AI models. Technical documentation, training summary, energy disclosure.

Stated maximum penalty — Up to 3% turnover or €15M

GPAI enforcement & fines (Art. 101)

Binds GPAI model providers (enforced by the Commission / AI Office). Commission may fine GPAI providers; supervision powers begin.

Stated maximum penalty — Up to 3% global turnover or €15M

Article 50 transparency & deepfake labelling

Binds Providers & deployers of interactive, synthetic-content or biometric AI. Disclosure of AI interaction; marking of AI-generated content.

Stated maximum penalty — Up to 3% turnover or €15M

EU AI Act — GPAI Enforcement Procedures Implementing Regulation (EU) 2026/1755

Binds General-Purpose AI (GPAI) model providers whose models are placed on the EU market or whose services are used in the EU. Binding procedural rules activating Commission enforcement against GPAI model providers: (1) providers must grant Commission technical access to models on demand — including APIs, source code, weights, and infrastructure — for AI Act evaluations under Art. 92; (2) detailed proceedings rules for investigations leading to Art. 99–101 fines, including rights of defence, 21-day minimum observation period, oral hearings, and 5-year limitation period. All communications require qualified electronic signatures.

Published OJ L 2026/1755 on 21 July 2026; enters into force on the twentieth day following publication (10 August 2026), per Art. 12 of the Regulation.

Stated maximum penalty — Implementing regulation activates fines under Art. 99-101 of Reg. (EU) 2024/1689: up to 3% of global annual turnover for GPAI providers (Art. 101(3)); up to 1% for false/misleading information

New prohibitions — AI CSAM / intimate imagery

Binds All providers / deployers of such AI systems. New Art. 5 prohibition added by Digital Omnibus (Reg. EU 2026/1744, OJ L 2026/1744 published 24 Jul 2026); prohibits AI generation of CSAM and non-consensual intimate imagery. Applies from 2 Dec 2026.

Prohibition introduced by Regulation (EU) 2026/1744; the new Article 5 prohibition applies from 2 December 2026.

Stated maximum penalty — Up to 7% turnover or €35M

High-risk AI obligations (Annex III)

Binds Providers & deployers of Annex III high-risk AI (employment, credit, education, biometrics, law enforcement, migration). Omnibus (Reg. EU 2026/1744, OJ L 2026/1744 published 24 Jul 2026) defers high-risk obligations for standalone Annex III systems from 2 Aug 2026 to 2 Dec 2027.

Regulation (EU) 2026/1744 (Digital Omnibus) published in the Official Journal; application of the Annex III high-risk obligations is deferred to 2 December 2027.

Stated maximum penalty — Up to 3% turnover or €15M

EU AI Act high-risk obligations (Annex I — product-embedded)

Binds Providers and deployers of AI systems embedded in regulated products listed in Annex I (medical devices, general product safety, machinery, toys, aviation, automotive, railway). Omnibus (Reg. EU 2026/1744, OJ L 2026/1744 published 24 Jul 2026) defers high-risk obligations for AI embedded in Annex I regulated products (medical devices, machinery, toys, aviation) from 2 Aug 2026 to 2 Aug 2028.

Regulation (EU) 2026/1744 (Digital Omnibus) published in the Official Journal; application of the Annex I product-embedded high-risk obligations is deferred to 2 August 2028.

Stated maximum penalty — Up to 3% global turnover or €15M