The Date That Matters
On August 2, 2026, the next major phase of the EU AI Act takes full effect. The obligations on providers and deployers of general purpose AI models move from transition period to enforcement. Fines for noncompliance reach 7 percent of global annual revenue or 35 million euros, whichever is higher.
That is a material sum. For a 500 million dollar revenue company, the top fine is 35 million. For a 10 billion dollar revenue company, it is 700 million.
If your engineering team is using ChatGPT, Claude, Copilot, or Cursor on EU employee data or EU customer data, you are a deployer under the Act. Shadow AI governance is now a regulatory problem, well beyond an internal policy matter.
This post covers what changes on August 2, what enterprises must have in place, and what 90 days of readiness work looks like.
What the Act Does
The EU AI Act is the first major horizontal regulation on AI systems. It classifies AI applications by risk level and assigns obligations based on the classification.
- -Prohibited systems: social scoring, biometric categorization for sensitive attributes, emotion recognition in workplaces. These are banned.
- -High risk systems: AI in critical infrastructure, education, employment decisions, credit scoring, law enforcement. Heavy compliance burden including conformity assessments and post-market monitoring.
- -General purpose AI (GPAI): large models like GPT, Claude, Gemini. New transparency and documentation obligations, especially for models above a compute threshold.
- -Minimal risk: most consumer AI. Voluntary codes of conduct.
Engineering teams using GPAI for code work sit in the GPAI bucket as deployers. The deployer obligations are the focus of the August 2 deadline.
What Changes August 2, 2026
Three things happen on August 2:
- -GPAI provider obligations become enforceable. Model providers must document training data, publish summaries of copyrighted content used in training, and maintain technical documentation. This is on OpenAI, Anthropic, Google, Meta.
- -Deployer obligations crystallize. Companies that deploy AI systems into their workflows must maintain logs, conduct risk assessments on high risk use cases, and inform affected employees when AI is used for decisions about them.
- -Enforcement authorities activate. Each member state designates a national competent authority. The EU AI Office coordinates cross-border cases. Fines become collectible.
The transition period ends. Companies that have been saying "we will get to this" run out of runway.
The Shadow AI Problem
Here is the hardest part of EU AI Act readiness for most enterprises. The Act requires deployers to maintain records of AI system usage. Every one of them, approved and unapproved alike.
A 2026 Gartner survey of 200 EU enterprises found 71 percent lacked an inventory of AI tools in use by developers. Engineers had onboarded Claude, Copilot, Cursor, and a dozen smaller tools while skipping security review. The compliance team lacked any way to audit what had been sent to which provider.
Shadow AI governance is the specific problem the Act exposes. Keeping records of usage requires seeing that usage. Assessing risk requires knowing which tools are in play. Informing employees about AI decisions requires knowing which tool made them.
The Act asks for visibility into shadow AI, a lower bar than banning it. Even so, it is the bar most enterprises miss today.
The Data Residency Trap
EU AI Act readiness interacts with GDPR in a way that catches a lot of teams off guard. If a developer based in Frankfurt pastes EU customer code into an API call to a US provider, the data has crossed the Atlantic. That is a GDPR transfer, subject to either SCCs or an adequacy decision, plus the AI Act logging requirement on top.
Most US model providers have data residency options, and they cost extra and require contract changes. Most engineering teams using Copilot or Cursor on laptops stay on the default endpoint, and the default routing goes to US data centers.
A bank we work with audited their outbound API traffic in February 2026. 89 percent of Copilot traffic from their Frankfurt office went to Azure US East. The compliance team was unaware. The engineers assumed Microsoft handled the residency automatically. Residency applies only when you buy the right SKU and configure the endpoint.
What CISOs Must Have on August 2
Based on the Act text plus guidance from national authorities published so far, a compliant GPAI deployer needs 5 artifacts on August 2:
- -AI system inventory. A list of every AI tool in use, what it is used for, which employees use it, what data it processes, and where the processing happens.
- -Risk assessment for each deployed system. Categorize by risk tier. Document why. Update quarterly.
- -Audit log of AI interactions. Every request to a GPAI API, with timestamp, user, prompt fingerprint, provider, and residency. Retained for at least 10 years for high risk, shorter for other tiers.
- -Employee notification records. Documentation that employees were informed about AI use in decisions affecting them, where applicable.
- -Data protection impact assessment (DPIA). Joint Article 35 GDPR and AI Act assessment for any AI system processing personal data.
The inventory plus the audit log is the hardest part. An audit log only covers the period after logging starts, so the logging infrastructure needs to be running before August 2.
The 90-Day Readiness Plan
If your team is starting now, you have 108 days from April 16 to August 2. Here is the 90-day version.
Days 1 to 14: Discover
Run a network audit. Pull 90 days of DNS logs and proxy logs. Identify all traffic to api.openai.com, api.anthropic.com, api.github.com/copilot, cursor.sh, and the 20 smaller providers. Build the initial inventory.
Interview engineering leads. Every team. Ask what AI tools they are using, for what, with what data. Expect shadow AI to show up.
Days 15 to 30: Classify
For each tool, document the use case, the data it processes, and the classification under the Act. Most code tools land in the limited risk or GPAI deployer bucket. Some may land in high risk if they touch HR or credit decisions.
Days 31 to 60: Deploy Controls
Install an AI firewall on developer laptops. Pretense, or an equivalent, routes all API calls through a local proxy that mutates identifiers and produces an audit log. This gives you 2 deliverables at once: shadow AI visibility and the audit log requirement.
Configure residency endpoints on approved tools. Force Copilot to use EU endpoints. Verify with traceroute; treat vendor paperwork as secondary evidence.
Days 61 to 90: Document and Test
Write the DPIA. Run a tabletop exercise simulating a regulator request. Can you produce the inventory in 72 hours? Can you show the audit log for a specific user for a specific date range? If either answer is shaky, close the gap in tooling first; the paperwork follows.
What Counts as Compliance Evidence
Policy documents are a starting point. A written AI acceptable use policy is necessary, and regulators will also ask for evidence of enforcement.
A vendor certification from your AI provider covers the provider. The Act holds deployers responsible for deployment decisions, so the inventory stays your job, separate from OpenAI's.
An employee handbook is background material. The Act requires specific notifications at specific times for specific decisions. A general handbook line is evidence of intent; compliance takes the specific notifications.
Fines Are Real
The Act includes 3 fine tiers:
- -Prohibited AI use: up to 35 million euros or 7 percent of global revenue.
- -Most other violations: up to 15 million euros or 3 percent of global revenue.
- -Incorrect information to authorities: up to 7.5 million euros or 1 percent of global revenue.
The 7 percent tier is the one that matters. For a company with 1 billion euro revenue, the ceiling is 70 million euros. For a company with 10 billion, it is 700 million. These are real exposures. The EU collected over 2 billion euros in GDPR fines in 2024. The AI Act is expected to follow a similar enforcement curve.
The Bottom Line
August 2, 2026 is 108 days from now. The enterprises that will be compliant on that date are deploying the controls now. The ones that wait until July will miss.
The 2 highest leverage moves: build the AI tool inventory this month, and install the audit logging infrastructure next month. Both take under 90 days if prioritized. Both become impossible to backfill after the deadline.
