EU AI Act Enters Enforcement With Fines of up to 3% of Annual Revenue

The European Union's AI Act entered its enforcement phase on August 2, as transparency obligations came into force, requiring users to be told they are interacting with an artificial intelligence system and generated or manipulated content to be labelled, including deepfakes.

Sanction powers over providers of general-purpose AI models were also activated, with penalties reaching EUR 15 million or 3% of annual revenue, whichever is higher, while the supervisory machinery combining the European AI Office and member-state market surveillance authorities began operating.

By contrast, the Digital Omnibus package deferred use-based high-risk obligations to December 2027 and product-embedded systems to August 2028. That deferral, however, represents a preparation period rather than an exemption, since its final step of publication in the Official Journal has not yet been completed.

At the operational level, buyers, accelerators and investors have already begun requesting system classification evidence as part of procurement and due diligence. European startups without documented risk mapping therefore face the prospect of valuation discounts or tougher contractual terms.

Key terms explained:

High-risk systems: AI applications affecting individual rights or safety, such as hiring, education and medical devices, which face stricter obligations.

General-purpose AI models: Large models suited to many tasks and used to build other applications, known as GPAI.

AI Office: A European Commission body overseeing enforcement of the act and imposing fines on model providers.

Due diligence: A detailed review by an investor or buyer to verify a company's position before completing a transaction.

Risk mapping: Documentation classifying each AI system inside a company and the risks tied to its use.

Official Journal: The European Union's official publication, in which legislation must appear before taking effect.