The EU AI Act's August Deadline: What Actually Changed

Yesterday brought a wave of headlines about new EU rules for general-purpose AI. Most framed 2 August 2026 as the day the rules arrived.

They did not arrive. Those duties have been binding since 2 August 2025. What changed is that the Commission can now punish a provider that ignores them. A grace period ended. That is a smaller story on paper. It is a bigger one in practice.

Key Takeaways

• Duties for general-purpose AI providers have applied since 2 August 2025. The rules are a year old.
• From 2 August 2026 the AI Office can demand documents, test models, order fixes, fine up to 3% of global turnover, and pull a model from the EU market (European Commission, 2026).
• Providers who signed the Code of Practice get credit for it when penalties are set.

What changed on 2 August 2026

The European Commission put it plainly. From that date, "the AI Office and authorities of the Member States are responsible for implementing, supervising and enforcing the AI Act" (European Commission).

The powers that switched on are specific. The AI Office may:

• request information and technical documentation from a provider
• request access to a model in order to evaluate it
• require risk mitigation measures
• impose fines of up to 3% of global annual turnover
• require a provider to restrict, withdraw or recall a model from the EU market

That last one is the sharp edge. A fine is a cost. A recall order pulls a product out of the entire EU market.

Three terms are worth pinning down. Reporting blurs them often:

• A GPAI model is a general-purpose AI model. It is trained broadly and used for many tasks, not built for one job.
• The AI Office is the Commission body that supervises GPAI models. It now holds the powers listed above.
• The Code of Practice is a voluntary pledge. Signing it does not replace the law. It does shape how the Commission treats you.

Why the "new rules" framing is wrong

The duties are not new. Since 2 August 2025, providers of these models have had to publish a summary of their training content. They have also had to run a copyright policy, keep technical documents, and manage systemic risk (AI Act Service Desk).

What the Commission held back was the machinery. It ran a one-year collaboration period first. It worked with providers, above all those who signed the Code of Practice, so models could reach the EU market without delay. From 2 August 2026 it enforces full compliance, including through fines (guidelines for GPAI providers). The scope of those duties is set out in the Commission's guidelines on GPAI scope.

Independent trackers describe the same split, noting that the supervision machinery was held back for a year and that the grace period ended on 2 August 2026 (AI Act enforcement tracker).

So the correct summary is short. The law did not change yesterday. The consequences did.

Since 2 August 2025	Since 2 August 2026
Publish a training-content summary	Commission can demand the documentation
Maintain a copyright policy	Commission can evaluate the model directly
Keep technical documentation	Fines up to 3% of global turnover
Assess and mitigate systemic risk	Orders to restrict, withdraw or recall

The part that matters if you run a website

Most coverage aims at the labs. There is a second audience, and it rarely gets addressed.

The training-content and copyright duties lean on machine-readable signals. Publishers already use these to say do not mine me. They include robots.txt rules, ai.txt files, and text-and-data-mining reservations. A GPAI provider serving the EU market must run a policy that respects them.

For a site owner, that changes the weight of a file most people set once and forget. Your robots.txt is no longer just a polite request. For anyone training a general-purpose model for the EU market, it now feeds a legal duty. And that duty can now be enforced.

Two practical consequences follow.

1. Audit what you publish. Check the rules your site serves today. A stale line from 2019 may now do work you did not intend.
2. Choose on purpose. Blocking AI crawlers costs you citations in AI answers. Allowing them trades that for training use. Either choice is fine. Drifting into one is not.

Platform rule changes often land on small publishers this way. We saw it with the Google Play age verification checks on Android. The rule aims at big players. The paperwork lands everywhere.

What this does not do

Scope matters here. The AI Act is large, and the August date is often described as if it switched on all of it.

Enforcement from 2 August 2026 covers banned AI practices, transparency duties for some AI systems, and the GPAI rules. High-risk duties run on their own clock. The Commission's implementation timeline sets out the dates.

Nor does it make every AI product in Europe illegal overnight. Providers who engaged during the collaboration year sit in a better spot. The Commission has said it will weigh Code of Practice pledges when it sets a penalty. That is the reward for showing up early.

For example, take a provider that published a thin training summary in 2025 and ignored follow-up questions. It is exposed now in a way it was not last month. Consider the opposite case. A provider that signed the Code and kept its documents current sits about where it did in July.

Frequently Asked Questions

What changed in the EU AI Act on 2 August 2026?

Enforcement did. The duties for general-purpose AI providers applied from 2 August 2025. From 2 August 2026 the Commission and the AI Office can demand documents, test models, order fixes, fine up to 3% of global turnover, and require withdrawal from the EU market.

How large are the AI Act fines for GPAI providers?

For breaches of the GPAI obligations, up to 3% of global annual turnover or €15 million, whichever is higher. Other parts of the Act carry higher ceilings.

Does the EU AI Act apply to my website?

Not directly, if you only publish content. It applies to providers of AI models and systems. It still matters to publishers. The copyright duties lean on machine-readable opt-out signals that your site controls.

Does signing the Code of Practice make a provider compliant?

No. It is voluntary and does not replace the legal duties. The Commission has said it will treat signing as good faith and weigh it when it sets penalties.

The short version

Nothing in the rulebook changed yesterday. The Commission just gained the power to act on rules that have been in force for a year.

If you build general-purpose models for the EU market, ask one question. Would your training-content summary and copyright policy survive a document request? If you publish a website, the question is smaller and sharper. Do you know what your own crawler rules say today?