EU AI Act

The EU AI Act is the world's first comprehensive legal framework for artificial intelligence, passed by the European Parliament in March 2024 and entering staged enforcement from August 2025. It classifies AI systems into four risk tiers: unacceptable risk (prohibited outright), high risk (mandatory conformity assessments), limited risk (transparency obligations), and minimal risk (no requirements). High-risk categories include AI used in employment decisions, education, credit scoring, law enforcement, and critical infrastructure. The Act also imposes specific obligations on providers of general-purpose AI (GPAI) models — from August 2025, the AI Office gained the power to audit and fine non-compliant GPAI providers up to 7% of global annual turnover.

The most significant upcoming milestone is 2 August 2026, when the AI Office gains full enforcement powers over GPAI providers — arriving just six days after the DMA Google FRAND decision is expected on 27 July. No pre-enforcement guidance letters from the AI Office have surfaced in the four weeks preceding GPAI activation; a General Court ruling on any DMA appeal from Alphabet would arrive after GPAI enforcement had already started. The two instruments converge without a published coordination mechanism between them. High-risk employment AI provisions, which would take effect in August 2026, may be delayed 24 months under the Digital Omnibus package.

The Act has become a major battleground in the sovereignty debate. Supporters argue it creates a global gold standard for AI governance and gives European regulators enforceable leverage over US tech firms. Critics, including Mistral CEO Arthur Mensch, warn it risks handicapping European AI labs relative to US and Chinese competitors who face no equivalent burden. South Korea enacted the world's second comprehensive AI law in January 2026, on an explicitly innovation-first model that contrasts with the EU's risk-first approach.

On 7 May 2026, the European Council and Parliament reached a provisional agreement on the Digital Omnibus on AI, splitting the Act's enforcement clock into two tracks. The Annex III high-risk AI compliance deadline — covering employment, education, biometrics, critical infrastructure, and border control — moved from 2 August 2026 to 2 December 2027, a 16-month delay. GPAI enforcement remained fixed at 2 August 2026, unchanged. The split reflects a political bargain: innovation-first pressure from industry groups and member states secured the delay on the employment and public-service AI categories most controversial for employers, while the Commission held firm on GPAI powers, which target frontier model providers like OpenAI, Google DeepMind, and Anthropic.

For European tech sovereignty, the Omnibus deal carries two competing signals. Positively, GPAI enforcement from August 2026 gives the AI Office a live enforcement lever over US frontier labs operating in EU markets — the first time a European regulator has had real statutory power over the largest AI companies. Negatively, the December 2027 delay removes the one AI Act provision most relevant to European public-sector procurement (high-risk AI in public administration) from the near-term compliance calendar, weakening the Act's short-term leverage over AI deployed in EU government services.

The Aleph Alpha/Cohere merger, expected to close in H2 2026, means the merged entity will face GPAI compliance obligations under the August enforcement date while simultaneously navigating Bundeskartellamt and Canadian Competition Bureau clearance — a compressed regulatory timeline for Europe's largest sovereign AI consolidation.