EU AI Act enforcement: what startups calling model APIs must do

EU AI Act enforcement started on August 2, 2026. From that day the European Commission's AI Office and national authorities can supervise and fine. The same day, the Article 50 transparency rules began to apply. They require you to tell people when they are talking to an AI system and to mark AI-generated content so machines can detect it. If your startup calls a model API and offers the result to people in the EU, these rules can reach you, even from Canada. This update reads the EU AI Act for startups in that position. The AI Omnibus, in force since July 27, 2026, moved the high-risk dates to December 2027 and August 2028.

What changed

• Enforcement is live. The AI Office enforces the rules for providers of general-purpose AI models and for AI systems built by the same provider as the underlying model. It also enforces them for AI in very large online platforms and search engines. National authorities enforce the rules for all other AI systems.
• EU AI Act Article 50 applies. Providers must design AI systems that interact with people so those people know they are dealing with AI, unless it is obvious. Providers of systems that generate synthetic audio, images, video or text must mark the output in a machine-readable format so it can be detected as AI-generated. Deployers must disclose deepfakes, and must disclose AI-generated text published to inform the public on matters of public interest, unless a person reviewed it and someone holds editorial responsibility.
• Notice comes first. The information must be clear and given at the latest at the first interaction or exposure.
• Guidance exists. The Commission published guidelines on the AI Act transparency obligations in Article 50 on July 20, 2026, and a Code of Practice on transparency of AI-generated content. On July 31 it published a first list of more than 180 organizations that signed that code.
• The AI Omnibus changed the timeline. With the AI Omnibus high-risk delay, rules for the uses listed in Annex III now apply from December 2, 2027. Rules for AI inside regulated products (Annex I) apply from August 2, 2028. Generative systems already on the market before August 2, 2026 have until December 2, 2026 to meet the marking rule. A new ban on AI that generates non-consensual intimate images or child sexual abuse material applies from December 2, 2026. The AI literacy duty in Article 4 was simplified, and some relief for small and medium-sized firms now extends to small mid-caps.
• Fines are set. Breaching Article 50 can cost up to EUR 15 million or 3% of worldwide annual turnover. For startups and other SMEs, the cap is whichever of the two is lower. Prohibited practices carry up to EUR 35 million or 7%.

Who is affected

• Startups that ship an AI feature under their own name. The Act calls you a provider when you have an AI system developed and place it on the market under your own name or trademark. A support bot, assistant or agent built on a third-party model and sold as part of your product fits that definition. The Act also uses the term downstream provider for a provider that integrates someone else's model.
• Startups whose product generates content. If users get images, audio, video or text from your system, the marking duty sits with the provider of the AI system. That can be you, not only the model vendor.
• Startups that use AI to publish. Deepfakes and AI-written public-interest text carry deployer duties.
• Companies outside the EU. The Act applies to providers that place AI systems on the EU market wherever they are based. It also applies to providers and deployers in other countries when the output is used in the EU. A Toronto startup with EU customers can be in scope.
• Not you, in most cases: the model rules. The obligations for general-purpose AI models sit with the companies that provide those models. Calling an API does not make you a model provider. If you fine-tune or otherwise modify a model, read the Commission's guidelines for providers of general-purpose AI models, because modification can change your role.
• Startups in high-risk areas. Annex III covers uses such as recruitment and work management, education and creditworthiness scoring. Those rules now start on December 2, 2027.

What to do now

1. List your AI features. For each one, note the model vendor, what it outputs and whether EU users see it. Note too whether you are the provider (you ship it under your name) or the deployer (you use it in your own work).
2. Add an AI notice to chat and agent features. Show it at the first interaction, in plain words, in the interface itself.
3. Check content marking. Find out what machine-readable marking your model vendor already applies, test whether it survives your own resizing, compression and editing, and add marking where it is missing. If your generative feature launched before August 2, 2026, your date is December 2, 2026.
4. Label deepfakes and public-interest text that leaves your company without human editorial review.
5. Keep AI literacy real. Article 4 still asks providers and deployers to take measures that support the AI literacy of staff who run or use AI systems. A short training note and a record of who took it is a sensible start.
6. Ask your model vendor for its downstream documentation. Model providers must give providers who integrate their models information and documentation. If that fails, the AI Office runs a complaints channel for downstream providers.
7. Flag high-risk uses early. If you score people for jobs, credit or education, start the gap analysis now. December 2027 is close in product time.
8. Bring in counsel for the legal calls. Role, scope and exemptions depend on facts, and this update is not legal advice.

Key dates

1. August 1, 2024the AI Act entered into force.
2. February 2, 2025prohibited practices and the AI literacy duty started to apply.
3. August 2, 2025obligations for general-purpose AI model providers and the governance rules started to apply.
4. July 27, 2026the AI Omnibus entered into force.
5. August 2, 2026the Act applies generally; enforcement powers and Article 50 transparency duties start.
6. December 2, 2026marking deadline for generative systems already on the market before August 2, 2026; ban on non-consensual intimate imagery and child sexual abuse material generation applies.
7. August 2, 2027general-purpose AI models placed on the market before August 2, 2025 must comply.
8. December 2, 2027high-risk rules for Annex III uses apply.
9. August 2, 2028high-risk rules for AI in regulated products (Annex I) apply.

How we help with EU AI Act enforcement

We are engineers, not lawyers. We can map every AI feature and model call in your product, add clear AI notices and content marking, and give your counsel the technical facts they need. That work is part of our AI integration consulting. If an investor or buyer is asking, our technology due diligence consulting covers AI use as part of the review. Our guide to the technical due diligence process sets out the steps. Regulation dates also sit in our software end-of-life tracker for startup stacks.