The EU AI Act's enforcement just began — here's the new line item on your AI budget

While most AI teams were watching token prices and agent costs, a different clock ran out. On August 2, 2026, the European Commission's enforcement powers over general-purpose AI models activated, and Article 50's transparency duties became live law. This is not a deadline on the horizon. It already happened.

August 2 already happened

It is easy to have missed it. The EU AI Act's most-discussed provisions — the sweeping obligations for "high-risk" AI systems — were pushed back in June, when the European Parliament approved a set of "Digital Omnibus" amendments by a 423-57 vote, delaying high-risk compliance to December 2027 and, for certain sector-specific obligations, to August 2028. That delay dominated the coverage, and understandably: it affected the largest, most complex compliance workstream in the Act.

But the delay applied to high-risk systems specifically. It did not touch two other obligations that were always scheduled for August 2, 2026: Article 50's transparency duties, and the European Commission's active enforcement toolkit over general-purpose AI (GPAI) model providers — information requests, model access, and recall powers, all newly usable against any GPAI provider now in scope. Both are live as of eleven days ago.

What actually takes effect (it's narrower than you think — and that's not the same as small)

Article 50 does not regulate what your AI does. It regulates whether people know they're dealing with it. Four obligations are now enforceable:

• Chatbot disclosure. Users must be told they are interacting with AI, in the interaction itself — not buried in a terms-of-service page they never open.
• Machine-readable marking of AI-generated content. Text, image, audio, and video produced by AI must be marked so it is technically detectable as AI-generated, and that marking has to survive normal editing and export pipelines.
• Deepfake labeling. Synthetic media depicting real people or events in a way that could plausibly be mistaken for authentic requires a visible disclosure.
• Disclosure for AI-generated public-interest text, unless the content underwent genuine human editorial review with a named responsible editor.

Pre-existing systems get a grace period to December 2, 2026 for the machine-readable watermarking requirement specifically — everything else is enforceable now. Any organization running a customer-facing chatbot for EU users, generating marketing or creative content touching the EU, or publishing AI-assisted text on matters of public interest is already in scope.

What got pushed back, and why that matters for your roadmap

The high-risk AI system obligations — the rules covering things like AI used in hiring, credit scoring, and critical infrastructure — now land in December 2027, with certain sector-specific requirements extended to August 2028. If your organization's compliance roadmap was built around an August 2026 high-risk deadline, that work isn't wasted, but it isn't urgent in the way it looked six months ago either.

The risk in that delay is complacency bleeding into the parts of the Act that weren't delayed. Teams that spent 2026 preparing for high-risk obligations and treated Article 50 as a footnote inside that larger project may now find the footnote is the only part of the law currently enforceable against them.

The price of getting it wrong

The EU AI Act's penalty structure runs in tiers under Article 99: up to €35 million or 7% of global annual turnover, whichever is higher, for prohibited practices; up to €15 million or 3% for most other breaches, a category that includes Article 50 violations; and up to €7.5 million or 1% for supplying incorrect information to regulators. GPAI model providers face a separate, parallel regime under Article 101 — also up to €15 million or 3% of global turnover — set directly by the European Commission and enforced by the European AI Office rather than national authorities.

Enforcement of Article 50 itself runs through decentralized national market surveillance authorities rather than a single EU body, which means the practical experience of an investigation will vary by member state — but the ceiling on the fine does not. A newly banned category is worth noting too: so-called "nudifier" applications are now prohibited outright, with a transitional period to December 2, 2026.

Governance is no longer a rounding error in the AI budget

This regulatory shift lands on top of a budget trend already in motion. According to Gartner, AI governance now claims 8-12% of the average enterprise AI budget in 2026, up from just 3-5% in 2024 — the fastest-growing line item in enterprise AI spend, growing faster than model costs themselves. Industry estimates for large enterprises put first-year compliance costs for the Act's obligations broadly in the high single-digit to mid-teens millions of euros, covering documentation frameworks, risk management processes, conformity assessments, and ongoing monitoring infrastructure — though the August 2 obligations specifically are narrower in scope than that figure implies for most organizations, closer to what one legal analysis called "a two-sprint project" for chatbot disclosure and content marking alone.

The pattern connects directly to how AI cost overruns happen in practice: a separate 2026 survey found 30% of organizations that overran their AI budget pointed to unmanaged or poorly governed AI usage as the direct cause. Governance was already showing up as a cost driver before a single euro of Article 50 fine had been issued. Treating compliance as legal's problem, disconnected from the team tracking AI spend, is how that 8-12% line item turns into an unbudgeted surprise instead of a forecasted cost.

A practical checklist for the weeks ahead

1. Audit every customer-facing chatbot serving EU users. Confirm AI disclosure happens inside the interaction, not in a linked policy document.
2. Verify machine-readable marking survives your actual content pipeline — export, compression, and re-upload steps have been known to strip metadata-based marking silently.
3. Document editorial control for AI-assisted public-interest content, with a named responsible editor on record, wherever human review is your basis for exemption.
4. Label synthetic media depicting real people or events used in any EU-facing campaign, immediately — this is the highest-visibility, most enforcement-likely category.
5. Give AI governance its own budget line and forecast for the rest of 2026 and into 2027, sized against the 8-12% benchmark rather than absorbed silently into general AI spend.
6. Connect whoever owns compliance to whoever owns AI cost tracking. The data says these are already the same failure mode wearing two names — treat them as one workstream.

The bottom line

The AI Act didn't get weaker in June — it got narrower in what's due first. Article 50 and GPAI enforcement are live now, with real fines attached, and they apply well beyond the handful of frontier labs most coverage focuses on. Any team shipping a chatbot or AI-generated content to EU users has a compliance obligation today, not in 2027. The organizations treating that as a budgeted, owned line item — not a legal afterthought bolted onto an already-stretched AI budget — are the ones who won't be surprised by the next enforcement date on the calendar.