EU AI Act in 2026: What Changed, Who's Affected and What's Next
The EU AI Act is now fully enforced. Here is what changed in 2026, who must comply, and what it means for global AI products.
As of February 2026 the most consequential AI law in the world — the European Union's AI Act — is fully enforced for general-purpose AI providers. Fines reach €35 million or 7% of global turnover. Here is the plain-English summary every founder, marketer and developer needs.
Why this matters globally
Like GDPR before it, the EU AI Act sets the de facto global standard. Any company offering AI products to EU users must comply, including American and Chinese providers. Brussels has effectively become the world's AI regulator.
What changed in 2026
- General-purpose AI (GPAI) obligations now in force.
- Mandatory transparency: synthetic media must be machine-detectable.
- High-risk systems require third-party conformity assessment.
- Banned uses (social scoring, real-time biometric ID in public) now criminal in most member states.
The four risk tiers
Unacceptable risk
Banned outright: social scoring, manipulative behavioural systems, untargeted facial scraping.
High risk
Allowed with conformity assessment: hiring, credit, education, law enforcement, critical infrastructure.
Limited risk
Transparency obligations: chatbots must disclose they are AI, deepfakes must be labelled.
Minimal risk
Most consumer AI: spam filters, video games. No new obligations.
What this means for AI tool builders
Every commercial chatbot now displays an "AI generated" disclosure on first interaction. Every image generator embeds C2PA. Every model card published by OpenAI, Anthropic and Google now includes EU-mandated systemic-risk evaluations. Read more in our image generator guide.
Fines and enforcement
- €35M or 7% turnover for prohibited uses.
- €15M or 3% for high-risk non-compliance.
- €7.5M or 1.5% for misleading regulators.
Real-world impact
The first wave of enforcement actions in March 2026 targeted recruitment AI vendors. The European Commission also opened formal proceedings against two large model providers over training-data transparency. Expect more in the second half of the year.
What other regions are doing
The UK is finalising its sector-specific approach; California passed SB-1047-light covering frontier model evaluations; China continues to prioritise content control. The fragmented landscape rewards companies that build EU-grade compliance and apply it globally.
Verdict
The EU AI Act is here to stay. Treat it as product guidance, not bureaucratic friction. Done well, transparency and safety obligations build user trust and reduce long-term legal risk.
Future outlook
Expect EU AI Office guidance documents through 2026, sectoral codes of practice for media and finance, and the first major court rulings by 2027.
Frequently asked questions
Does the EU AI Act apply to companies outside the EU?+
Yes. Any provider offering AI products to EU users is in scope, regardless of where the company is based.
What is the penalty for breaching the AI Act?+
Up to €35 million or 7% of global annual turnover for prohibited uses — whichever is higher.
Do chatbots need to disclose they are AI?+
Yes. Limited-risk transparency rules require chatbots to clearly inform users they are interacting with an AI system.
Sources & further reading
Enjoyed this article?
Subscribe for daily AI deep-dives — no spam, ever.
