The penalty regime goes live on August 2 — what is actually enforceable

The enforcement and penalty framework becomes operational on 2 August 2026. That the high-risk obligations were deferred does not defer the machinery that punishes breaches of the rules already in force.

The bands are unchanged. Prohibited practices carry exposure up to €35 million or 7% of worldwide turnover. Most other breaches reach €15 million or 3%. Supplying misleading information to an authority reaches €7.5 million or 1%. SMEs and small mid-caps face the lower of each pair.

In practice the near-term risk sits with the prohibitions in force since February 2025 and the transparency duties arriving alongside the penalties. A generative provider that fails to mark synthetic output now faces a regime with teeth, not just guidance.