The EU AI Act: GPAI Enforcement from 2 August 2026 and What the Digital Omnibus Postponed

The EU AI Act has been in force since August 2024, but many of its obligations take effect in stages. One date stands out: on 2 August 2026 active enforcement against providers of general-purpose AI models (GPAI) begins through the EU AI Office, and national sanction regimes take effect in parallel. In Germany the accompanying AI Measures and Innovation Act (KI-MIG) applies. Anyone who uses or provides AI should know the deadline, but also the most recent postponements.

What begins on 2 August 2026

The obligations for GPAI models have applied since August 2025. What is added in August 2026 is enforcement: one year after applicability, the AI Office gains the powers to actually act on them. These include information requests, access to models and, as a last resort, the recall of a model. An obligation on paper thereby becomes an enforceable one.

For most companies the relevant role is not that of the GPAI provider, but that of a deployer or provider of downstream systems. They too should know which transparency and documentation obligations take effect when.

What the May 2026 Digital Omnibus postponed

On 7 May 2026 the EU, through the so-called Digital Omnibus, stretched the timeline for individual sub-obligations. This does not change the August deadline for GPAI enforcement, but it shifts other building blocks:

• High-risk systems under Annex III: postponed to 2 December 2027.
• High-risk systems under Annex I: postponed to 2 August 2028.
• Transparency obligations under Article 50 (such as labelling AI-generated content): postponed to 2 December 2026.
• AI regulatory sandboxes: postponed to 2 August 2027.

This stretching is not a free pass. It buys time for the more demanding high-risk requirements, but leaves GPAI enforcement and the national sanctions in August untouched.

What this means in practice

Three tasks are worthwhile regardless of the exact date. First, an inventory: which AI systems does the company use or provide, and into which risk class do they fall? Without this clarity, no deadline can be planned meaningfully. Second, transparency: from December 2026, Article 50 requires that certain AI interactions and AI-generated content be made recognisable. Third, documentation, because enforcement from August rests on obligations not only being met but also being evidenced.

This last point connects the AI Act with the other compliance regimes. Whether NIS2, DORA or the AI Act, the recurring requirement is a traceable, auditable record of what a system does and who is accountable for it. A platform that produces this record as a by-product of operation anyway makes preparation easier, for any regime. The task itself, however, stays the same: first know what you operate, then evidence that it complies.

The 2nd of August 2026 is not an abstract date. It is the point at which the GPAI obligations grow teeth. What the Digital Omnibus postponed concerns the high-risk track, not this core.