The EU AI Act Rolls Out in Phases: From Entry into Force to GPAI Obligations

The world's first comprehensive AI regulation — the EU AI Act — entered into force on August 1, 2024 and is rolling out in phases: prohibitions and AI-literacy requirements applied from February 2, 2025, and obligations for general-purpose AI (GPAI) model providers took effect on August 2, 2025. This piece first ran in August 2025 and was updated on September 21, 2026; the main change is the schedule, since the draft line that high-risk obligations would 'phase in through 2026-2027' is now out of date.

The act classifies AI applications by risk level, imposing transparency, data-governance and human-oversight obligations on high-risk uses like biometrics and critical infrastructure, with fines of up to 7% of global revenue. For large-model providers like OpenAI and Google, the GPAI obligations make training-data transparency and systemic-risk assessment hard requirements.

The schedule itself was rewritten in 2026: at the end of July 2026 the AI/Digital Omnibus was finally approved, pushing the full obligations for high-risk systems — previously set to phase in through 2026-2027 — back to 2028, while transparency obligations became fully applicable in August 2026 (see JD Supra's rundown of the deal). Analysts note the EU's legislation remains the key reference template for AI regulatory frameworks worldwide — but that its effective dates are themselves negotiable is now part of the lesson.

Where the Phased Rollout Actually Bites#

For vendors, the real watershed in the timeline is August 2025's GPAI obligations: mandatory public summaries of training data, copyright-compliance policies, and extra assessments plus incident reporting for models deemed to carry 'systemic risk' — requirements that touch model makers' most sensitive trade secret: where the data comes from. The companion GPAI Code of Practice is voluntary; OpenAI, Google and Anthropic signed, while Meta publicly refused — signing or not became a statement of regulatory posture in itself.

The fine structure rewards close reading too: violations of the prohibitions carry penalties of up to 7% of global revenue, above GDPR's 4% — the EU rates AI violations as more serious than privacy ones.

Can the Brussels Effect Repeat#

GDPR leveraged market access to make EU rules a de facto global standard, but whether the AI Act can replicate that 'Brussels effect' is doubtful: the US has pivoted decisively to innovation-first (see our US AI Action Plan coverage), China runs its own labeling-and-filing regime (see our China content-labeling coverage), and the three jurisdictions are hardening into separate blocs. Inside Europe, industry worry that compliance costs handicap homegrown players like Mistral keeps fermenting, and lobbying for simplification never stopped — by the Paris AI Action Summit the EU had audibly softened its tone (see our summit coverage), and that pressure is what ended in the July 2026 omnibus deferral.

Our Take#

The AI Act's value lies less in its clauses than in making 'risk tiers + phased effect' the shared vocabulary of global regulation; its risk is equally clear — if only giants can afford compliance, the law entrenches incumbent advantage. The practical takeaway for anyone shipping into the EU: the 2028 slippage on high-risk obligations buys a longer runway, it does not grant an exemption — transparency duties have been fully applicable since August 2026, so get training-data inventories and risk-assessment processes on the books now rather than cramming after the first enforcement case. The GDPR-era habit of taking rules seriously only after the first mega-fine is far too expensive under a 7% ceiling.