Twenty-Five Days: What Actually Activates on 2 August

The AI Act’s most consequential remaining date is now twenty-five days out, and the popular reading - “Brussels delayed everything” - is precisely wrong about it. The Digital Omnibus moved the high-risk calendar; it did not move 2 August. On that day three separate mechanisms activate at once, and the readiness picture for each is different. This brief takes them in order of who should be nervous.

One: the Commission can finally fine model providers

Providers of general-purpose AI models have been under substantive obligations since 2 August 2025 - technical documentation, copyright policies, training-data summaries, systemic-risk duties above the 10²⁵-FLOP threshold - but the Commission’s power to penalise them arrives only now, closing a one-year grace period. This enforcement is centralised in the AI Office, which means it does not wait for national bureaucracies; and its compliance pathway has a public roster. Roughly 24 organisations have signed the GPAI Code of Practice - Amazon, Anthropic, Google, IBM, Microsoft and Mistral among them - while Meta has declined outright and xAI signed only the safety chapter, a posture the Commission has signalled will draw heightened scrutiny. The first enforcement question of the autumn is therefore already written: what happens to the non-signatories’ “alternative adequate means.”

Two: Article 50 transparency, with its Code now final

The four transparency duties this desk has tracked all year - machine disclosure, machine-readable marking of generated content, biometric and emotion-recognition notices, deepfake labelling - apply from 2 August as scheduled. The last missing instrument landed on 10 June, when the Commission published the final Code of Practice on marking and labelling AI-generated content; the Omnibus’s only concession here is a four-month grandfather, to 2 December 2026, for generative systems already on the market before the deadline. Penalties: up to €15 million or 3% of worldwide turnover.

Three: the sandbox deadline, and the quiet readiness gap

Article 57 requires every member state to have at least one operational AI regulatory sandbox by 2 August - part of a broader national scaffold that also includes designated market-surveillance authorities. As of June, those designations remain incomplete across the bloc: practitioners are openly calling it the “enforcement gap,” legal authority activating ahead of the machinery to use it. The asymmetry this creates is the brief’s key point: model providers face a ready, centralised enforcer from day one; system-level transparency enforcement will phase in unevenly, member state by member state. Companies triaging by fine exposure should triage by that asymmetry.

The week’s garnish, for completeness

Brussels is not slowing into the deadline. On 7 July the Commission presented an EU Action Plan on Cybersecurity and AI, including a promised call to expand European model-evaluation capacity toward an operational third-party assessment function by 2027; on 19 June it selected the EUROPA consortium to build an open-source European frontier model in all 24 official languages. Neither changes an obligation on 2 August. Both signal where enforcement capability is being built next.