As described in our post on the Code of Practice, deepfakes and AI-generated content on topics of public interest must be clearly labeled. Users must also be able to recognize when they are interacting with an AI system such as a chatbot. The goal is to prevent deception and strengthen public trust in sources and informational infrastructures.

The framework surrounding fines also takes effect as of this date. For the most serious violations, such as prohibited AI practices, fines of up to €35 million or 7% of global annual revenue are possible; for the remaining obligations, fines of up to €15 million or 3% could apply.

As of August 2026, clear labeling obligations take effect. Deepfakes as well as AI-generated or AI-manipulated text on matters of public interest must be clearly labeled. Users must also be able to recognize when they are interacting with an interactive AI system such as a chatbot. The regulation aims to prevent deception and manipulation and to strengthen trust in the information ecosystem. 
The obligations under Article 50 apply regardless of whether a company signs the code or not. 

The code was drawn up by independent experts with input from more than 180 stakeholders and is divided into two sections. Section 1 addresses providers of generative AI systems: it describes how AI-generated audio, image, video, and text content is marked in a machine-readable format and made detectable as artificially generated. Section 2 addresses deployers. It governs the labeling of deepfakes and of AI-generated text published without human review and editorial responsibility. In addition, the EU provides a set of standardized icons that deployers can use to label their AI-generated content. 

Companies are being given more time to implement high-risk requirements. For AI systems in areas such as biometrics, critical infrastructure, education, employment, law enforcement, and border management, the deadline is now December 2, 2027. For systems embedded as safety components, the deadline is pushed back to August 2, 2028. Watermarking obligations for AI-generated content, however, will apply as early as December 2, 2026. 

In addition, the agreement includes a new prohibition: AI systems capable of generating non-consensual sexual or intimate content, as well as the AI-assisted creation of child sexual abuse material, are explicitly banned. This clarification was one of the most frequently requested changes by critics of the AI Act. 

Duplicate requirements for AI components in machinery products are being eliminated, the definition of “safety component” is being narrowed, and SME simplifications are being extended to smaller mid-cap companies. Companies will also gain access to an EU-wide regulatory sandbox to test AI products prior to market entry. 

The most immediate impact concerns the scope of the CSRD. Reporting thresholds have been significantly raised. Going forward, only EU companies that cumulatively meet both of the following criteria are subject to mandatory reporting: 

• More than 1,000 employees on an annual average 

• Net turnover exceeding €450 million 

This effectively removes most companies originally in scope. Listed SMEs and mid-sized groups, many of which had already invested heavily in building reporting infrastructure, are now fully exempt. For companies that remain subject to reporting obligations, the first reporting period covers fiscal year 2027, with reports due in 2028. 

With the new requirements taking effect, the standards for suspicious activity reports are being further refined. This particularly affects the scope of information to be submitted, the structured capture of relevant data fields, and a stronger alignment with risk-based criteria.

Reports must continue to be submitted exclusively through the electronic reporting portal goAML. Proper registration with the FIU remains a mandatory prerequisite.

More than 1,000 amendment proposals were incorporated during the drafting of the law. The result is a hybrid approach designed to avoid duplicate structures and build on what already works. The Federal Network Agency takes on the central role as a coordination and competence center, pooling AI expertise that it makes available to other authorities as needed.

For companies, this means one thing above all: they keep their familiar regulatory points of contact. The market surveillance authorities that already exist will remain responsible for product regulation and will now also cover the requirements of the AI Regulation. This “one-stop-shop principle” is intended to reduce red tape and create clarity.

The EU AI Act (Regulation (EU) 2024/1689) was formally adopted in March 2024 and regulates the use of artificial intelligence based on a risk-based tiered approach. While certain AI systems with “unacceptable risk” have already been banned since February 2025, 2 August represents the start of a new phase: Compliance with the regulations will now be actively enforced with clear legal consequences.

The objective of the regulation is to align innovation and competitiveness with core European values such as transparency, data protection, and human rights.