The Date That Matters
On August 2, 2026, the next major phase of the EU AI Act takes full effect. The obligations on providers and deployers of general purpose AI models move from transition period to enforcement. Fines for noncompliance reach 7 percent of global annual revenue or 35 million euros, whichever is higher.
That is not a rounding error. For a 500 million dollar revenue company, the top fine is 35 million. For a 10 billion dollar revenue company, it is 700 million.
If your engineering team is using ChatGPT, Claude, Copilot, or Cursor on EU employee data or EU customer data, you are a deployer under the Act. Shadow AI governance is now a regulatory problem, not an internal policy problem.
This post covers what changes on August 2, what enterprises must have in place, and what 90 days of readiness work looks like.
What the Act Does
The EU AI Act is the first major horizontal regulation on AI systems. It classifies AI applications by risk level and assigns obligations based on the classification.
- -Prohibited systems: social scoring, biometric categorization for sensitive attributes, emotion recognition in workplaces. These are banned.
- -High risk systems: AI in critical infrastructure, education, employment decisions, credit scoring, law enforcement. Heavy compliance burden including conformity assessments and post-market monitoring.
- -General purpose AI (GPAI): large models like GPT, Claude, Gemini. New transparency and documentation obligations, especially for models above a compute threshold.
- -Minimal risk: most consumer AI. Voluntary codes of conduct.
Engineering teams using GPAI for code work sit in the GPAI bucket as deployers. The deployer obligations are the focus of the August 2 deadline.
What Changes August 2, 2026
Three things happen on August 2:
- -GPAI provider obligations become enforceable. Model providers must document training data, publish summaries of copyrighted content used in training, and maintain technical documentation. This is on OpenAI, Anthropic, Google, Meta.
- -Deployer obligations crystallize. Companies that deploy AI systems into their workflows must maintain logs, conduct risk assessments on high risk use cases, and inform affected employees when AI is used for decisions about them.
- -Enforcement authorities activate. Each member state designates a national competent authority. The EU AI Office coordinates cross-border cases. Fines become collectible.
The transition period ends. Companies that have been saying "we will get to this" run out of runway.
The Shadow AI Problem
Here is the hardest part of EU AI Act readiness for most enterprises. The Act requires deployers to maintain records of AI system usage. Not just the approved ones. All of them.
A 2026 Gartner survey of 200 EU enterprises found 71 percent had no inventory of AI tools in use by developers. Engineers had onboarded Claude, Copilot, Cursor, and a dozen smaller tools without security review. The compliance team had no way to audit what had been sent to which provider.
Shadow AI governance is the specific problem the Act exposes. You cannot maintain records of usage you cannot see. You cannot assess risk on tools you did not approve. You cannot inform employees about AI decisions made by a tool you did not know existed.
The Act does not require banning shadow AI. It requires visibility. That is a lower bar, but it is the bar most enterprises fail today.
The Data Residency Trap
EU AI Act readiness interacts with GDPR in a way that catches a lot of teams off guard. If a developer based in Frankfurt pastes EU customer code into an API call to a US provider, the data has crossed the Atlantic. That is a GDPR transfer, subject to either SCCs or an adequacy decision, plus the AI Act logging requirement on top.
Most US model providers have data residency options but they cost extra and they require contract changes. Most engineering teams using Copilot or Cursor on laptops are not using the EU residency endpoint. The default routing goes to US data centers.
A bank we work with audited their outbound API traffic in February 2026. 89 percent of Copilot traffic from their Frankfurt office went to Azure US East. The compliance team had no idea. The engineers assumed Microsoft handled the residency automatically. It does not, unless you buy the right SKU and configure the endpoint.
What CISOs Must Have on August 2
Based on the Act text plus guidance from national authorities published so far, a compliant GPAI deployer needs 5 artifacts on August 2:
- -AI system inventory. A list of every AI tool in use, what it is used for, which employees use it, what data it processes, and where the processing happens.
- -Risk assessment for each deployed system. Categorize by risk tier. Document why. Update quarterly.
- -Audit log of AI interactions. Every request to a GPAI API, with timestamp, user, prompt fingerprint, provider, and residency. Retained for at least 10 years for high risk, shorter for other tiers.
- -Employee notification records. Documentation that employees were informed about AI use in decisions affecting them, where applicable.
- -Data protection impact assessment (DPIA). Joint Article 35 GDPR and AI Act assessment for any AI system processing personal data.
The inventory plus the audit log is the hardest part. You cannot backfill the audit log from nothing. You need the logging infrastructure running before August 2.
The 90-Day Readiness Plan
If your team has not started, you have 108 days from April 16 to August 2. Here is the 90-day version.
Days 1 to 14: Discover
Run a network audit. Pull 90 days of DNS logs and proxy logs. Identify all traffic to api.openai.com, api.anthropic.com, api.github.com/copilot, cursor.sh, and the 20 smaller providers. Build the initial inventory.
Interview engineering leads. Every team. Ask what AI tools they are using, for what, with what data. Expect shadow AI to show up.
Days 15 to 30: Classify
For each tool, document the use case, the data it processes, and the classification under the Act. Most code tools land in the limited risk or GPAI deployer bucket. Some may land in high risk if they touch HR or credit decisions.
Days 31 to 60: Deploy Controls
Install an AI firewall on developer laptops. Pretense, or an equivalent, routes all API calls through a local proxy that mutates identifiers and produces an audit log. This gives you 2 deliverables at once: shadow AI visibility and the audit log requirement.
Configure residency endpoints on approved tools. Force Copilot to use EU endpoints. Verify with traceroute, not with vendor paperwork.
Days 61 to 90: Document and Test
Write the DPIA. Run a tabletop exercise simulating a regulator request. Can you produce the inventory in 72 hours? Can you show the audit log for a specific user for a specific date range? If not, the gap is in the tooling, not the paperwork.
What Does Not Count as Compliance
Policy documents alone do not count. A written AI acceptable use policy is necessary but not sufficient. Regulators will ask for evidence of enforcement.
A vendor certification from your AI provider does not count. The Act holds deployers responsible for deployment decisions. You cannot outsource the inventory to OpenAI.
An employee handbook does not count. The Act requires specific notifications at specific times for specific decisions. A general handbook line is evidence of intent, not of compliance.
Fines Are Real
The Act includes 3 fine tiers:
- -Prohibited AI use: up to 35 million euros or 7 percent of global revenue.
- -Most other violations: up to 15 million euros or 3 percent of global revenue.
- -Incorrect information to authorities: up to 7.5 million euros or 1 percent of global revenue.
The 7 percent tier is the one that matters. For a company with 1 billion euro revenue, the ceiling is 70 million euros. For a company with 10 billion, it is 700 million. These are not theoretical. The EU collected over 2 billion euros in GDPR fines in 2024. The AI Act is expected to follow a similar enforcement curve.
The Bottom Line
August 2, 2026 is 108 days from now. The enterprises that will be compliant on that date are deploying the controls now. The ones that wait until July will miss.
The 2 highest leverage moves: build the AI tool inventory this month, and install the audit logging infrastructure next month. Both take under 90 days if prioritized. Both become impossible to backfill after the deadline.
