EU AI Act: Fines of up to 35 Million Euros

Fines of up to 35 million euros, or 7% of global annual turnover, are now a working tool for European regulators. On August 2, the European Commission started enforcing the AI Act, two years and one day after the regulation entered into force. The same day, labeling obligations kicked in, and they reach every company, shop and newsroom that has put a machine between itself and its users.

What Changes Today

Chatbots, voice agents, virtual assistants and avatars must tell users they are talking to a machine, not a person. Content that artificial intelligence created or altered, meaning images, audio and video, must carry a label, and that label has to be machine readable so platforms and researchers can detect it. The obligation also covers text published to inform the public that has not gone through human editorial review. Users of emotion recognition and biometric categorization systems must be told they are exposed to such a system.

Oversight is split across three bodies:

• national market surveillance authorities in EU member states
• the AI Office at the Commission, for systems under its remit
• the European Data Protection Supervisor, when EU institutions are the ones providing or using the system

The Commission’s Executive Vice President for Tech Sovereignty, Henna Virkkunen, described the start of enforcement in a statement as a matter of trust, not control.

“As enforcement begins, we are taking an important step towards artificial intelligence that people and businesses can understand and trust, and whose benefits are widely shared across our society.”

Alongside the enforcement start, the Commission published the first list of more than 180 organizations that signed the Code of Practice on the transparency of AI generated content. The code is voluntary, but it gives companies a way to demonstrate they have met their obligations.

How Much Are the Fines?

Penalties are set at three levels:

• up to 35 million euros or 7% of global annual turnover for prohibited practices
• up to 15 million euros or 3% of global turnover for breaching other obligations, including those of general purpose model providers
• up to 7.5 million euros or 1% of turnover for supplying false or misleading information to supervisory authorities

For EU institutions the ceiling is 750,000 euros, and the amounts are scaled down for small and medium enterprises and small mid cap companies. As of the same date, the Commission can for the first time formally investigate general purpose model providers, order corrective measures and fine them, even though those obligations have technically applied since last August.

What’s Delayed and What Isn’t

Five days before the main date, on July 27, 2026, Regulation (EU) 2026/1744, the so called AI Digital Omnibus, entered into force. It pushed back the costliest part of the obligations, the one covering high risk systems, but it did not move the general enforcement date. Rules from Annex III, which include employment, credit scoring, education, biometrics and the judiciary, were postponed to December 2, 2027, while systems embedded in products under Annex I were pushed to August 2, 2028.

The timeline so far runs like this: the regulation entered into force on August 1, 2024, bans on certain practices became applicable on February 2, 2025, and obligations for general purpose models applied from August 2, 2025. Today closes a one year window in which the rules were in effect but carried no penalties.

The enforcer’s capacity is known: the AI Office has 145 staff across six teams, 38 of them in the safety team and 34 in the regulatory supervision group. Another 38 positions have been proposed, but that depends on the EU’s 2027 budget procedure. Enforcement is also starting under external pressure, since Brussels has announced an 890 million euro fine against Google under the Digital Markets Act, which drew a sharp reaction from the US administration.

Why This Matters for Serbian Software Exporters

The obligation follows the system placed on the EU market, not the company’s headquarters, and that is where the bill lands for domestic software houses. A user of a system reclassifies as a provider the moment it fine tunes a commercial model on its own data, adapts it to its own needs, or markets it under its own name and trademark. That shifts a company from the lighter regime into the full provider regime, with technical documentation, compliance proof and exposure to the fines listed above.

A bank that fine tunes a model on conversations with its own clients, a retailer that sells someone else’s conversational assistant under its own brand, and a software house that embeds someone else’s model into its own product are all candidates for reclassification. For Serbian firms delivering solutions to EU clients, this is no longer a legal question for later. As of today it is a line item in the contract and in the price.

The next date on the calendar is December 2, 2026. By then, systems that were already on the market before today must receive a machine readable label, while the obligation to tell a person they are talking to a machine has applied since this morning.