Europe’s most ambitious attempt yet to police artificial intelligence has entered a new and more consequential phase. As of this weekend, the European Commission holds full authority to investigate, sanction and fine providers of general-purpose AI models under the bloc’s AI Act, marking the moment the law shifts from being a set of obligations on paper to one backed by real enforcement teeth.
Companies building large AI systems — from chatbots to image generators — have technically been subject to transparency obligations for months, but until now Brussels lacked the legal power to act on breaches. That changes with this rollout: regulators can now demand documentation, interview staff, and impose penalties reaching as high as seven percent of a company’s global annual turnover for the most serious violations. Alongside the new enforcement powers, fresh transparency rules also take effect, requiring that AI-generated content, chatbots and synthetic media carry clear labels or watermarks so users can tell when they are interacting with a machine rather than a human, or viewing content that was artificially generated.
To back up the new powers, the EU has expanded its dedicated AI Office in Brussels with dozens of additional staff tasked with monitoring compliance among AI developers ranging from major American cloud providers to Chinese model makers. The office has also launched tools allowing tech workers to flag concerns confidentially and enabling the public to report suspected violations, such as the circulation of AI-generated sexually explicit material or synthetic content designed to deceive. Officials have framed the expansion as a direct response to the pace at which AI capabilities are advancing, warning that regulators cannot afford to fall behind the technology they are meant to oversee.
That concern was underscored just days before enforcement began, when researchers reported what appears to be the first documented case of an autonomous AI agent independently carrying out an unplanned cyber operation — an incident that has reignited debate over whether current rules are adequate for AI systems capable of acting without direct human oversight at each step. Some policy analysts argue the AI Act, largely designed around the risks posed by specific AI models and their outputs, was not built with highly autonomous, tool-using AI agents in mind, and may need further revision to keep pace.
The rules are not static. A separate package of amendments, agreed earlier this summer through what officials call a Digital Omnibus process, adjusted the compliance timeline for higher-risk AI systems. Standalone systems falling under the law’s strictest category now have until the end of 2027 to fully comply, while AI embedded in already-regulated products, such as medical devices and industrial machinery, has been given until 2028. Lawmakers describe this as a sequencing adjustment rather than a retreat from regulation, intended to give companies more realistic timelines for the most complex compliance requirements while transparency and disclosure rules move ahead on schedule.
Most major AI developers, including large US cloud and model providers, have signed onto a voluntary code of practice that helps demonstrate compliance with the law’s general-purpose AI provisions. Notably, some platforms have taken a narrower approach, agreeing only to safety-related commitments while declining the law’s fuller compliance framework, and at least one major social media company has not signed on at all.
Because the AI Act applies to any AI system used within the EU regardless of where the company developing it is based, its influence is already rippling well beyond Europe’s borders. Companies in North America, Asia and elsewhere are increasingly building their global AI governance programmes around the EU framework as a common baseline — a pattern regulators and analysts alike describe as a repeat of the so-called “Brussels effect,” in which EU rules become an unofficial global standard simply because market access depends on compliance with them. Next Article
