What the AI Act is, and why 2 August matters
The AI Act entered into force on 1 August 2024, but its rules apply progressively.
Some obligations are already in effect: since February 2025, AI practices posing an unacceptable risk have been banned (such as social scoring or emotion recognition in the workplace), and since August 2025 the rules on governance, penalties and general-purpose AI models (such as the models behind ChatGPT or Gemini) have been in force.
On 2 August 2026, "the rest" of the regulation becomes applicable, as indicated by the European Commission.
The most tangible change for most companies concerns the transparency obligations set out in Article 50: anyone using chatbots must clearly inform users that they are interacting with an automated system, and AI-generated or AI-manipulated content (including deepfakes) must be labelled as such.
One easing applies: for generative AI systems already on the market before 2 August 2026, the machine-readable marking obligation for synthetic content (Article 50(2)) takes effect on 2 December 2026. All other transparency obligations — chatbot disclosure, deepfakes, emotion recognition — apply from 2 August 2026 with no extension.
These are rules that apply directly to tools already in widespread use, such as chatbots on corporate websites or generative AI used for content and communication.
What about "high-risk" tools, like AI for CV screening?
Here an important clarification is needed — one often overlooked by less up-to-date articles on the subject. The AI Act classifies certain particularly sensitive uses as "high-risk", including AI tools used in recruitment (for example, automated CV screening) and in worker management. Originally, these obligations — technical documentation, risk management, human oversight — were also due to take effect on 2 August 2026.
However, with Regulation (EU) 2026/1744 of 8 July 2026 — the so-called "Digital Omnibus on AI", the simplification package published in the Official Journal on 24 July 2026 — the European Parliament and the Council, acting on a Commission proposal, postponed the application of the rules on "standalone" high-risk systems (including recruitment, biometrics, critical infrastructure, education, migration and justice) to 2 December 2027.
For AI systems embedded in regulated products (such as lifts or toys), the deadline is instead set at 2 August 2028.
In short: from 2 August 2026, it is mainly the transparency obligations on chatbots and AI-generated content that kick in; the more demanding obligations for tools classified as high-risk allow more time to comply, but remain firmly on companies' agendas between now and 2027.
Penalties: up to 7% of global turnover
The penalties provided for by the AI Act are structured across three tiers, based on the severity of the infringement:
- up to €35 million or 7% of total worldwide annual turnover, for the use of prohibited practices;
- up to €15 million or 3% of turnover, for breaches of the other obligations (including transparency requirements and those falling on organisations deploying high-risk systems);
- up to €7.5 million or 1% of turnover, for incorrect or misleading information supplied to the authorities.
For SMEs and start-ups, penalties are calculated on whichever is lower — the percentage or the fixed amount.
What to do, in practice
Before worrying about penalties, the first step is to understand what you actually have in-house: which AI tools the company uses, who supplies them, what they are used for, and what data they run on. Only on the basis of this mapping is it possible to determine which obligations will apply: transparency, risk management, or none at all (if the tool falls into the minimal-risk category!).
Companies that have already started mapping their AI tools will be ready when the time comes; the others still have just enough time, between now and the deadline, to avoid a last-minute scramble.
💡Better to invest a few hours in mapping today than to count the zeros on a fine tomorrow!