The AI Act's fine book just opened

I.The switch from “in force” to “enforceable”

The rules did not change on 2 August 2026. The consequences did. GPAI obligations under Chapter V of the EU AI Act have applied since 2 August 2025; from this month, the Commission may open investigations, demand documentation and model access, and impose fines — up to 3% of a provider's annual worldwide turnover or €15 million, whichever is higher, under Article 101.

The Commission's own press notice on 31 July framed the transition tersely: as of 2 August, “the European Commission's AI Office, together with national authorities, will begin enforcing” the Act. In parallel, transparency duties on the deployer side kicked in: interactive systems must disclose they are AI, deepfakes must be labelled, and synthetic content must carry machine-readable marks. The GPAI layer — the one that binds the labs that build models rather than the businesses that use them — is the one with money behind it.

Two grandfathering gates matter. Models placed on the EU market before 2 August 2025 have until 2 August 2027 to reach full compliance. Everything trained and released after that first date already had to meet the documentation, copyright and safety obligations by design; the Commission simply could not fine them for missing the mark until now.

II.Nine signed. Meta didn't.

Alongside the binding text, the AI Office negotiated a voluntary General-Purpose AI Code of Practice, finalised on 10 July 2025. Signatories get a “presumption of conformity”: regulators assume the signatory is meeting the underlying obligations unless something concrete suggests otherwise. Refusers get the same law and heavier scrutiny.

By August 2026 the signatory list read like a roster of Western frontier labs: Anthropic, Google, Microsoft, OpenAI, IBM, Amazon, Mistral AI, Cohere and Aleph Alpha have signed all three chapters (Transparency, Copyright, Safety and Security). Elon Musk's xAI signed only the Safety chapter. Meta declined outright. Anthropic said the Code “advances the principles of transparency, safety and accountability”; Meta's Joel Kaplan, its Chief Global Affairs Officer, called the Code an “over-reach” that would “throttle the development and deployment of frontier AI models in Europe.”

The split matters because it defines two regulatory postures inside the same market. Signatories accept a safe harbour: their documentation templates and safety-framework mechanics are pre-baked into a text the Commission helped write. Meta accepts the same underlying obligations without the safe harbour, and bets that its lawyers can defend a bespoke compliance regime under Commission scrutiny.

III.The office that has to police it has 165 people

The most sourceable skeptic case is not about the law — it is about the desk. The AI Office, the Commission unit inside DG CNECT that runs GPAI supervision, sits at roughly 165 staff after a recruitment of about 40 contractual agents announced this year. An independent review by Pour Demain, cited by Lawfare, judged the office “significantly underresourced relative to its mandate” and recommended scaling to at least 160 staff by 2030 — a target the office arguably reaches on the day it was told it needed to grow past it.

Compare that with the object of supervision. The four largest US hyperscalers alone plan roughly $725 billion of AI infrastructure spending in 2026. A single Big Tech legal-and-policy team is larger than the entire unit that must issue requests for information, run model evaluations, hire external evaluators, and defend enforcement in court.

That resource asymmetry does not mean the office will fail; the Digital Services Act moved from silent first year to symbolic fines within eighteen months. But it does explain why the honest technical read on 2 August 2026 is latent authority rather than an imminent fine wave. The Commission has the tools. It does not yet have the hands.

IV.Where the euros actually move

The direct fiscal impact of a first-day-of-enforcement moment is small; the second-order economic channel is where the money really flows. Three transmission mechanisms deserve tracking.

Compliance-cost split by size. For a five-person European startup building a limited-risk GPAI-derived product, first-year AI Act compliance falls in the €15,000–€31,000 range, rising to €46,500–€94,000 for a high-risk application (annual ongoing costs of €5–35k). These are estimates from a Vienna consultancy that specialises in the field, and readers should treat them as order-of-magnitude, not audited. The gradient matters more than the number: for OpenAI or Google the same fixed costs are trivial; for a two-person shop building an EU-facing agent product they are a meaningful share of first-year runway. The Act is size-neutral in text and regressive in practice.

Legal certainty as a moat. Signatories bought a written safe harbour. Non-signatories — principally Meta, and any smaller European lab that finds the Code's Copyright chapter incompatible with its data pipeline — must build bespoke compliance and defend it under adversarial scrutiny. This is a durable structural cost that scales with the number of member-state regulators who choose to test it.

Market-access risk on the open-weight tail. The Commission has flagged DeepSeek as a “highly likely” candidate for systemic-risk designation, whether or not it clears the 10²⁵ FLOP threshold on measured training compute. That signals a policy read in which capability-in-use, not just compute-at-training, drives classification — a shift that would tighten the perimeter for every downloadable open-weight model above frontier capability, from every jurisdiction.

V.The second-order effects nobody is pricing

Three consequences travel further than the fine schedule suggests. The first is the Brussels-effect question in AI. GDPR became a global privacy floor because compliance was cheaper to unify than to fork. If the AI Act's documentation templates — the summary of training data, the copyright-policy statement, the systemic-risk framework — become the default for products that touch the EU market, US and Chinese labs will effectively be writing to a European rubric even outside Europe. Signatories already are.

The second is the labour re-mix in the compliance stack. The Act does not directly displace developers, but it creates measurable demand for a new occupation: the GPAI compliance officer, the copyright-policy lawyer, the systemic-risk evaluator. On the industry side the seats already exist inside frontier labs; on the regulator side, only 165 people are on the payroll to match them. Expect a two-year hiring imbalance that will bid up compliance-side wages in Brussels and Frankfurt before it corrects.

The third is the export-control adjacency. The 10²⁵ FLOP threshold in Article 51 is a policy number that now interacts with US commerce-department compute caps, Chinese domestic chip supply, and the DeepSeek precedent. A single number chosen by Brussels is quietly aligning with a single number chosen by Washington. That is not an accident; it is a de-facto trans-Atlantic definition of “frontier.”

VI.How it plays out: three scenarios

Twelve-to-twenty-four-month horizon. Probabilities are analytical judgment, informed by the Commission's DSA enforcement precedent and the resource picture in Section III.