EU AI Governance Profile

Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies in phases. Chapters I and II, including the AI system definition, AI literacy, and prohibited practices, have applied since 2 February 2025. Governance rules, GPAI obligations, and penalties have applied since 2 August 2025. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was adopted on 8 July 2026 and entered into force on 27 July 2026. From 2 August 2026, the Commission’s AI Office and national authorities began enforcing the AI Act, and Article 50 transparency obligations started applying. The Omnibus extends the application date for certain Annex III high-risk rules to 2 December 2027 and product-integrated high-risk rules to 2 August 2028.

The AI Act uses a four-level risk logic in Commission-facing communications: unacceptable risk, high risk, transparency risk, and minimal or no risk. In legal terms, the binding structure is anchored in prohibited practices under Article 5, high-risk systems under Article 6 and Annex III plus product-safety legislation in Annex I, transparency obligations under Article 50, and model-level obligations for general-purpose AI under Chapter V. The Commission’s Code of Practice on Transparency of AI-Generated Content remains a voluntary compliance-support instrument; the Commission’s July 2026 adequacy opinion does not turn it into binding law or conclusive proof of compliance.

The EU governance architecture is hybrid. The AI Office, established within the Commission, supports implementation across the Union and directly supervises GPAI obligations. National market surveillance authorities supervise and enforce most system-level rules. The AI Board, Scientific Panel, and Advisory Forum provide coordination and expert or stakeholder input. The Commission’s August 2026 enforcement start and related complaints and whistleblower channels make that institutional layer operational rather than merely preparatory.

At EU level, the AI Office is the core implementation node. It was established within the Commission and is tasked with supporting coherent application of the AI Act, preparing guidance and implementing tools, investigating possible infringements, and supervising the most powerful general-purpose AI models. At member-state level, national competent authorities include market surveillance authorities and notifying authorities. For GPAI, Article 88 gives the Commission exclusive powers to supervise and enforce Chapter V. That centralization is one of the EU model’s most consequential structural choices.

At EU level, the AI Office is the core implementation node. It was established within the Commission and is tasked with supporting coherent application of the AI Act, preparing guidance and implementing tools, investigating possible infringements, and supervising the most powerful general-purpose AI models. The August 2026 enforcement start, complaints channel, and whistleblower tool show the institutional architecture moving into active operation.

At member-state level, national competent authorities include market surveillance authorities and notifying authorities. Market surveillance authorities supervise and enforce compliance for AI systems, including prohibited and high-risk rules, while notifying authorities designate and supervise notified bodies that carry out relevant third-party conformity assessment. The Digital Omnibus preserves this hybrid architecture while extending some high-risk implementation dates to allow more time for standards and support measures.

For GPAI, the legal architecture is more centralized than for other AI categories. Article 88 gives the Commission exclusive powers to supervise and enforce Chapter V, and the Commission entrusts those tasks to the AI Office. That centralization is one of the EU model’s most consequential structural choices.

For providers, the EU regime requires disciplined product governance. The immediate tasks are role-mapping, AI-system inventory, prohibited-practice screening, high-risk classification, documentation architecture, vendor-chain allocation, incident-handling pathways, and literacy measures. Article 50 transparency obligations are now applicable for in-scope systems, while the Digital Omnibus moves selected Annex III high-risk deadlines to 2 December 2027 and product-integrated high-risk deadlines to 2 August 2028.

For deployers, the main enterprise risk lies in use-context governance. Deployers cannot outsource all responsibility to vendors. They must ensure use consistent with instructions, assign competent human oversight, manage controlled input data, monitor operations, report serious incidents, satisfy notice duties in relevant cases, and—where applicable—carry out fundamental-rights impact assessments. Employers using AI in workforce contexts should pay particular attention to high-risk triggers in employment and worker-management use cases, as well as the workforce-facing implications of Article 4 literacy duties.

For GPAI providers and downstream integrators, the EU’s most distinctive burden is value-chain transparency. Documentation must flow downstream, copyright and training-content summary obligations must be operationalized, and systemic-risk providers must be prepared for Commission-facing engagement, including notification, evaluations, incident reporting, and cybersecurity expectations. The voluntary transparency code can support implementation but is not conclusive evidence of compliance.

Penalty exposure is material. Member-state penalties can reach up to EUR 35 million or 7% of worldwide turnover for prohibited-practice violations, and up to EUR 15 million or 3% of worldwide turnover for a broad set of operator, deployer, notified-body, and Article 50 obligations. GPAI providers face Commission-level fines up to 3% of worldwide turnover or EUR 15 million.

Regulation (EU) 2026/1755 adds binding procedural arrangements for Commission AI Act proceedings. Article 50 duties are already generally applicable, with a limited 2 December 2026 transition for Article 50(2) marking/detection on systems placed on the market before 2 August. High-risk classification guidance remains draft; separate applicable law from guidance still being finalized.

Observatory interpretation: The EU model is best understood as a layered governance stack rather than a single compliance rulebook. The statute sets the legal architecture, but actual enterprise burden is distributed across guidance, standards, conformity processes, national authorities, and role-specific controls. This is especially true for high-risk and GPAI governance.

Observatory interpretation: The EU’s most globally influential design choice is the split between centralized supervision for GPAI and decentralized supervision for most AI systems. That makes the EU simultaneously a market-regulation regime and a frontier-model governance regime.

Observatory interpretation: As of September 2026, the legal timeline is more settled than at the previous review because the Digital Omnibus is enacted and Article 50 enforcement has begun. Operational uncertainty remains around harmonised standards, final guidance, and how the extended high-risk dates interact with implementation capacity. The voluntary transparency code should be treated as a useful compliance-support instrument, not as binding law or conclusive proof of compliance.