The Legal Question
When did the European Union's Artificial Intelligence Act (Regulation (EU) 2024/1689, as amended by 2026/1744) become enforceable, and what obligations do non-European companies face under the newly activated enforcement regime?
EU AI Act: Scope and Territorial Reach
The Act's territorial reach is defined in Article 2(1). It applies to any provider that places a covered AI system or general-purpose AI model on the EU market, or that puts an AI system into service in the EU, irrespective of the provider's place of establishment. Additionally, Article 2(1)(c) extends the Act to non-EU providers whose AI system's output is used in the EU, creating a de facto extraterritorial effect. Even companies that operate solely outside the EU but whose products are accessed by EU users may be subject to the Act.
Institutional Architecture: The AI Office and National Authorities
On 2 August 2026, the EU Commission's AI Office, together with national authorities, began enforcing the Act. The AI Office holds exclusive supervisory and enforcement powers over general-purpose AI models under Article 88. National authorities are tasked with enforcing provisions that apply to AI systems placed on the market or put into service within their jurisdictions (Articles 8687). This dual-layer architecture creates a one-stop-shop for model providers and a nationwide framework for system providers, ensuring that compliance is monitored at both the EU and member-state levels.
Enforcement Powers and Penalties
The enforcement regime, inaugurated by the Commission's 31 July 2026 press release, introduces administrative fines up to 35 million or 7 per cent of worldwide annual turnover for prohibited practices, and up to 15 million or 3 per cent for other covered violations. The AI Office may issue information requests (Article 91), conduct evaluations (Article 92), impose restrictions or withdrawals (Article 93), and fine non-compliant model providers under Article 101. These powers are cumulative and apply irrespective of the size or location of the provider, provided the AI system or model falls within the scope of the Regulation.
Practical Implications for Global Operators
Transparency duties under Article 50 require providers of interactive AI systems that directly engage users to display a clear notice that the interlocutor is an AI system, unless the fact is obvious. This obligation is now fully enforceable. General-purpose AI model providers must maintain technical documentation, publish a training-content summary, and appoint an authorised representative in the Union if established outside the EU (Chapter V). While core high-risk requirements for many categories are postponed to December 2027, systems in regulated sectors such as biometrics, migration and justice must still meet current transparency and safety obligations under Article 6. Finally, if a company modifies a third-party model using more than one-third of the original training compute, it may trigger model-provider duties under Chapter V, potentially exposing it to the AI Office's enforcement powers.
Counter-Arguments and Limitations
Critics argue that the Act's extraterritorial reach may conflict with national sovereignty and the principle of territoriality under EU law. The one-stop-shop model could create regulatory duplication, as national authorities may still need to enforce overlapping provisions. Moreover, the broad definition of AI system and the lack of precise thresholds for high-risk classification can create compliance uncertainty for firms operating at the margins of the regulatory framework. The European Commission has acknowledged these concerns in its enforcement communications, promising guidance to narrow ambiguity in the coming months.
A practical path to compliance
Companies working across borders should first identify the particular systems they offer or use, the roles they occupy in the supply chain and the obligations that attach to each activity. Classification depends on the relevant definitions and the actual use of a system. A generic assurance that an organisation is “AI compliant” will not answer whether a specific product meets the applicable duties. The position also needs to be revisited when a system is substantially changed or put to a new use.
The stronger legal argument for the regime is that risks reaching users in the European Union justify obligations with effects beyond its borders. The counterargument concerns the burdens imposed on firms established elsewhere and the clarity of those obligations. Operators should document their classifications and the reasons for them, while policymakers should keep implementation guidance precise and accessible. The lasting test will be whether enforcement is predictable and proportionate in particular cases.