The EU AI Act's high-risk system requirements take full effect on August 2, 2026 — 110 days from today — carrying penalties of up to 35 million euros or 7 percent of global annual revenue, whichever is higher. [1] For context, 7 percent of Google's revenue would be roughly $22 billion. The fine structure deliberately exceeds GDPR's maximum, signaling that Brussels considers AI governance at least as consequential as data protection.

The Act bans eight categories of AI practice outright, including social scoring systems, real-time biometric surveillance in public spaces (with narrow law enforcement exceptions), and AI systems that exploit vulnerabilities related to age, disability, or economic circumstance. [2] High-risk systems — covering employment decisions, credit scoring, law enforcement, and critical infrastructure — must meet conformity assessments, maintain technical documentation, and submit to ongoing monitoring. [1]

Article 50 requires platforms to label all AI-generated content, a provision that forces transparency obligations on every foundation model provider operating in European markets. [3] The labeling requirement applies regardless of where the company is headquartered — a US-based AI company serving European users faces the same obligations as a Berlin startup.

Each EU member state must establish a National AI Office by August to oversee compliance and liaise with the EU AI Office. [4] The compliance infrastructure is substantial: risk assessments, bias audits, human oversight mechanisms, and incident reporting systems that most companies have not built. One AI industry analyst summarized the mood: "We'll figure it out later." [5] August suggests later has arrived.

-- DAVID CHEN, Beijing