The EU AI Act's transparency obligations came into force on 2 August 2026, and a new implementing regulation now sets out exactly how Brussels can assess and fine the makers of general-purpose AI models. Article 50 requires that people be told when they are interacting with an AI system and that AI-generated text, image, audio and video be marked in a machine-readable way. Deepfakes, emotion-recognition and biometric-categorisation systems carry their own disclosure duties. For chatbots and image generators already in production, the watermarking and disclosure features many teams bolted on as an afterthought now have the force of law.
The procedural teeth matter as much as the rules. Commission Implementing Regulation (EU) 2026/1755, published in the Official Journal on 21 July 2026, lays out two processes the Commission can run against providers of general-purpose models: formal assessments and enforcement actions. Under the assessment route, Brussels can demand access to a model through its API, source code, weights or hosting infrastructure and appoint independent experts. Penalty ceilings are steep: prohibited practices can draw fines of up to 35 million euros or 7 percent of global turnover; most high-risk breaches up to 15 million euros or 3 percent; and supplying incorrect or misleading information up to 7.5 million euros or 1 percent.
Crucially, liability flows downstream. A bank, law firm or insurer that calls an OpenAI or Anthropic model through an API is itself a regulated "deployer" under Article 26, with its own duties, including, in credit, insurance and public-sector uses, a possible fundamental-rights impact assessment. Article 4's AI literacy obligation requires organisations to train staff. Deployers relying on third-party models are expected to demand declarations of conformity and training-data summaries in their contracts, because the obligations pass through the supply chain. The deferred deadline for high-risk Annex III uses, such as recruitment and credit scoring, is 2 December 2027, but the compliance scaffolding has to be built now.
The European approach throws the American one into relief. More than 1,500 AI-related bills have been introduced across U.S. states in 2026, with 280 adopted, according to the National Conference of State Legislatures, up from 1,200 introduced and 227 adopted last year. Disclosure requirements and deepfake rules lead the list. That patchwork is forming not in the absence of federal action but in spite of it: President Trump's December 2025 executive order sought a light-touch national framework, and a Justice Department task force set up in January 2026 is challenging state laws it deems inconsistent with that policy. The result is the opposite of the EU's single rulebook, a state-by-state maze that insurers and compliance teams compare to the fragmented history of U.S. data-breach and privacy law.
Industry reaction is split between dread and relief. The penalties are large and the deployer liability is new, which reads as pure cost. But after two years of vague deadlines, companies finally know the shape of the wire, and the Commission's 20 July guidance on Article 50 gives a concrete map; fee-free regulatory sandboxes are mandated in every member state by August 2027. One practical sign of the stakes: the insurance market is already repricing AI exposure, with underwriters, as one cyber insurer put it, tapping the brakes after incidents in which rogue AI agents probed systems for vulnerabilities. What is not yet clear is how aggressively Brussels will use its new wrench, and whether a predictable rulebook becomes a competitive moat for compliant firms or simply a tax that pushes frontier development elsewhere.