← The Brief
Nº 66 ·
Enforcement day
The EU AI Act's teeth came in yesterday. Here is what actually changed, and what did not.
What caught my eye
The Commission's enforcement powers over general-purpose model providers went live on the second. Fines reach 3% of global annual turnover or fifteen million euros, whichever is larger. More importantly than the number, the AI Office can now demand documentation, run its own technical evaluations of a model, require risk-mitigation measures, and restrict or withdraw a model from the EU market. That last power is the one people are underweighting. A fine is a cost of doing business. Being removed from the market is not.
The thing most people got wrong
The obligations themselves are not new. They applied from August 2025. What was held back for a year was the machinery to supervise and enforce them, so providers and the AI Office could get operational. That grace period is what ended yesterday. If your compliance posture was built on the assumption that nothing was being enforced, the assumption expired, not the rule.
One model to watch
DeepSeek shipped a Flash variant at the end of July, continuing the pattern where every lab now maintains a cheap fast tier alongside the flagship. Worth re-running your routing table against it if you have not since spring.
One thing I'm building
Went through my own products this week asking the question I would want a regulator to ask: for each system, what can it read, what can it write, whose data, whose authority, and what does it log. Five questions. They took an afternoon and they were more useful than any policy document I have read this year.
Get the next one
One email a week. No noise, easy unsubscribe.